EUVD-2026-51000

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator...

CVE-2026-15257

The CVE concerns the RegistrationMagic WordPress plugin, specifically versions before 6.0.9.4. The affected component is the front-end submission-editing action, where the plugin fails to perform authorization, ownership, or nonce checks. This exposes unauthenticated attackers to overwrite other ...

CVE-2026-15257 RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator...

CVE-2026-15240

The CVE refers to the Customer Switching for WooCommerce plugin for WordPress, affected in versions before 2.1.3. The root cause is insecure binding of an active user-switching session to the initiating operator, allowing a lower-privilege account that an operator is switched into to be resolved ...

CVE-2026-12687 ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID

The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator whe...

CVE-2026-12687

The CVE describes a vulnerability in the ProfileGrid WordPress plugin prior to version 5.9.9.8 where the front-end registration does not restrict which group an anonymous visitor may join. This allows unauthenticated users to register directly into privileged groups and receive that group’s confi...

EUVD-2026-50992

The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator whe...

CVE-2026-14356

The FleekDash V2 WordPress plugin (up to version 2.6.2.2) is vulnerable to authorization bypass due to improper verification of user rights. authenticated users with subscriber-level access or higher can overwrite the email and password of any WordPress user, including administrators, enabling fu...

CVE-2026-67244

A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration input may be processed through an unsafe format string operation. An authenticated administrator can exploit this issue to disclose memory...

CVE-2026-67244 A format string vulnerability was found in the Notification OAuth settings of ADM

A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration input may be processed through an unsafe format string operation. An authenticated administrator can exploit this issue to disclose memory...

EUVD-2026-50953

A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration input may be processed through an unsafe format string operation. An authenticated administrator can exploit this issue to disclose memory...

PT-2026-66476

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.6.1 Description An authentication context confusion exists where password validation and session loading operate independently without ensuring both use the same user record. This allows an authenticated Editor ...

The vulnerability of the automatic update mechanism of PC ViPNet administrators, related to deficiencies in handling relative paths, allows a perpetrator from a neighboring trusted network to compromise the integrity of the operating environment of the target node by using a specially crafted update package, delivered on behalf of the compromised trusted node with the role of Network Management Center (NMC).

The vulnerability of the automatic update mechanism of PC ViPNet Administrator is related to deficiencies in the processing of relative paths. Exploiting this vulnerability can allow a perpetrator operating from a neighboring trusted network to compromise the integrity of the operating environmen...

CVE-2026-15831 Generation of Incorrect Security Tokens in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during tok...

CVE-2026-6089

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'stickysmedia' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the importsidebars function passing user-supplied URLs from imported JSON data to filegetcontents with...

CVE-2026-18201

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...

CVE-2026-6089

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'stickysmedia' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the importsidebars function passing user-supplied URLs from imported JSON data to filegetcontents with...

CVE-2026-6089

The WP CTA plugin for WordPress (all versions up to 2.1.2) is vulnerable to Server-Side Request Forgery via the sticky_s_media parameter in imported JSON. The import_sidebars() function passes user-supplied URLs to file_get_contents() after only FILTER_VALIDATE_URL validation, allowing internal I...

CVE-2026-11973

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-18201 Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...