CVE-2026-19127

CVE-2026-19127 affects the billing and license activation subsystem of the Postiz app. The issue arises from insufficient cryptographic validation or lack of server-side state verification for promotional/lifetime-deal (LTD) redemption codes, enabling an unauthenticated attacker to forge valid re...

CVE-2026-11965

The User Registration & Membership WordPress plugin before 5.2.0 does not enforce payment completion before activating a paid membership subscription, allowing unauthenticated users after self-registering an account through the open registration flow to obtain an active subscription on any paid...

EUVD-2026-41255

The User Registration & Membership WordPress plugin before 5.2.0 does not enforce payment completion before activating a paid membership subscription, allowing unauthenticated users after self-registering an account through the open registration flow to obtain an active subscription on any paid...