WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass

Stacks Mobile App Builder WordPress plugin ≤ 5.2.3 suffers from an authentication bypass vulnerability via improper handling of query parameters, allowing attackers to impersonate arbitrary users. id: CVE-2024-50477 info: name: WordPress Stacks Mobile App Builder =5.2.3 - Authentication Bypass...

CVE-2026-118267

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints wpda/app/update, wpda/app/delete,...

EUVD-2026-119157

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints wpda/app/update, wpda/app/delete,...

CVE-2026-121536

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to generic SQL Injection via the 'engine' parameter in all versions up to, and including, 5.5.90 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-118204

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ImageURL column value populated from wpusermeta.description in the demonstrated path' parameter in all versions up to, and including, 5.5.89 due...

EUVD-2026-118969

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Data Projects front-end simple form in versions up to, and including, 5.5.90 This is due to insufficient input sanitization and output escaping o...

EUVD-2026-118965

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ImageURL column value populated from wpusermeta.description in the demonstrated path' parameter in all versions up to, and including, 5.5.89 due...

EUVD-2026-118964

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to generic SQL Injection via the 'engine' parameter in all versions up to, and including, 5.5.90 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-139435

Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.89 Description Incorrect authorization allows for privilege escalation. The plugin fails to enforce row-filter defaultWhere or per-column allow-list isSelected restrictions on write endpoints, unlike the re...

VulnCheck KEV: CVE-2026-118267

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints wpda/app/update, wpda/app/delete,...

CVE-2026-110023

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'reltab' parameter. This makes it possible for unauthenticated attackers to extract every row and...

EUVD-2026-114647

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'reltab' parameter. This makes it possible for unauthenticated attackers to extract every row and...

PT-2026-134472

Name of the Vulnerable Software and Affected Versions WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps versions prior to 5.5.89 Description An issue exists that allows unauthenticated attackers to extract all rows and columns from the database table associated with any...

CVE-2026-110023: peterschulznl: The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to…

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'reltab' parameter. This makes it possible for unauthenticated attackers to extract every row and...

CVE-2026-94294

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...

CVE-2026-94294 App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...

CVE-2026-94294

The App Builder WordPress plugin (versions 3.8.4 through 5.7.0) contains a vulnerability where the application fails to require authentication or authorization before writing attacker-supplied data to one of its options. In a separate unauthenticated request, the plugin redirects the visitor's br...

WordPress App Builder plugin 3.8.4-5.7.0 - Unauthenticated Option Write and Redirect vulnerability

Unauthenticated Option Write and Redirect vulnerability discovered by RIA Labs in WordPress Plugin App Builder versions 3.8.4-5.7.0...

CVE-2026-94294 App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...

EUVD-2026-104107

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...