CVE-2026-103984

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limitusercustomervisibility is enabled, the loadcustomerinfo AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox....

CVE-2026-103984 FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limitusercustomervisibility is enabled, the loadcustomerinfo AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox....

CVE-2026-103984

FreeScout, a self-hosted help desk system, is vulnerable in versions prior to 1.8.231 due to an incomplete fix for CVE-2026-40570 . When limit_user_customer_visibility is enabled, the load_customer_info AJAX action allows a non-admin agent to perform a global lookup using an attacker-controlled c...

CVE-2026-113584

The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the...

CVE-2026-92396

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin, prior to version 2.4.4 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue stems from an AJAX action that fails to validate user capabilities or post ownership, combined with a failure to escape stored ...

EUVD-2026-117897

The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the...

CVE-2026-113584

The placester WordPress plugin (version 1.4.3 and below ) is vulnerable to unauthenticated account takeover. The root cause is a failure to perform capability, nonce, or ownership checks on an AJAX action designed to update account details. An unauthenticated attacker can exploit this to overwrit...

Youzify < 1.2.0 - Unauthenticated SQLi

The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection id: CVE-2022-1950 info: name: Youzify 1.2.0 - Unauthenticated SQLi author:...

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...

Web Directory Free < 1.7.0 - SQL Injection

The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. id: CVE-2024-3552 info: name: Web Directory Free 1.7.0 - SQL...

TranslatePress <= 3.3.1 - Unauthenticated Account Takeover

TranslatePress WordPress plugin = 3.3.1 contains a sensitive information exposure caused by the 'trpgettranslationsregular' AJAX action saving password-reset URLs in translation dictionary, letting unauthenticated attackers extract admin password-reset URLs, exploit requires automatic string savi...

WordPress KiviCare <2.3.9 - SQL Injection

WordPress KiviCare plugin before 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape some parameters before using them in SQL statements via the ajaxpost AJAX action with the getdoctordetails route. An attacker can possibly obtain sensitive information, modify...

WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting

WordPress WOOCS plugin before 1.3.7.5 is susceptible to cross-site scripting. The plugin does not sanitize and escape the woocsinordercurrency parameter of the woocsgetproductspricehtml AJAX action, available to both unauthenticated and authenticated users, before outputting it back in the...

CVE-2026-105971

The Car Dealer Dealership and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by...

EUVD-2026-117351

The Car Dealer Dealership and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by...

EUVD-2026-117346

The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment...

CVE-2026-90963 Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Contact Disclosure via property_print_ajax

The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email...

WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmptempaccessajax AJAX action being registered with wpajaxnopriv and protected only by a nonce check using the...

CVE-2026-105191

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users'...

CVE-2026-105191

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin versions before 1.17.11 is vulnerable to a sensitive data disclosure. The root cause is a missing capability check on an AJAX action that returns the stored before-and-after values of a record change. This flaw al...