CVE-2026-16304

The WP Event Manager WordPress plugin before version 3.4.2 is vulnerable to a content takeover due to insufficient validation of user-supplied post identifiers in one of its frontend forms. Any user with a Subscriber account or higher can exploit this to reassign the authorship of arbitrary posts...

CVE-2026-4301

The Rate Star Review Vote - AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. The vwrsrreview AJAX handler lacks both capability checks and nonce verification. The only access control is an isuserloggedin check...