2679 matches found
EUVD-2026-52173
The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs...
EUVD-2026-52163
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...
Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion
The Avada Fusion Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybedeletefiles function. An unauthenticated attacker can delete arbitrary files on the server by manipulating the filepath parameter in the...
Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure
The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frmformspreview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form. id: CVE-2017-20194 info...
CVE-2026-11872 Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item
The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered ...
CVE-2026-11872
The CVE-2026-11872 affects the Clever Mega Menu for Visual Composer WordPress plugin up to version 1.0.1. The root cause is a missing nonce or capability check in an AJAX action that updates navigation menu item metadata, enabling any authenticated user (including Subscribers) to overwrite menu i...
CVE-2026-16256 Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new...
EUVD-2026-51936
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...
CVE-2026-11872
The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered ...
CVE-2026-15151 Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...
CVE-2026-15151
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...
CVE-2026-67299
FreeRDP before 3.29.0 is affected by a client-side heap use-after-free in the async update path when WINDOW_ICON_ORDER is processed. In update_message_WindowIcon(), a shallow CopyMemory overwrites a newly allocated lParam->iconInfo with a parser-owned windowIcon->iconInfo pointer; after the...
CVE-2026-67299 FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp /async-update. In updatemessageWindowIcon a shallow CopyMemory overwrites a freshly allocated lParam-iconInfo with the parser-owned...
CVE-2026-67299 FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp /async-update. In updatemessageWindowIcon a shallow CopyMemory overwrites a freshly allocated lParam-iconInfo with the parser-owned...
CVE-2026-67301
FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...
CVE-2026-67301
FreeRDP 3.x before 3.29.0 is affected by an out-of-bounds read in the async update message proxy for PolygonSC/PolygonCB drawing orders. The bug occurs when AsyncUpdate is enabled: update_message_PolygonSC() and update_message_PolygonCB() allocate a new points array but copy data from the order s...
CVE-2026-14315
The Pixel Tag Manager for WooCommerce WordPress plugin is vulnerable in versions before 2.2.1: an AJAX action lacks authorization, letting unauthenticated users forge e‑commerce conversion events via the site’s configured server‑side advertising conversion APIs using stored credentials. Impact is...
CVE-2026-13329
The Buckaroo Woocommerce Payments Plugin for WordPress is affected: versions before 4.9.0 do not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds. This allows any authenticated user, including Subscribers, to trigger refunds against capture...
CVE-2026-13329
The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...
CVE-2026-12966
The CVE-2026-12966 issue affects the Direct Payments for WooCommerce WordPress plugin (pre-2.5.3). It allows unauthenticated attackers to tamper with other customers’ orders by abusing several unauthenticated AJAX handlers that do not verify ownership before changing order status and overwriting ...