15323 matches found
CVE-2026-27071 WordPress WPCafe plugin <= 3.0.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through = 3.0.7...
CVE-2026-27073 WordPress Addi – Cuotas que se adaptan a ti plugin <= 2.0.4 - Broken Authentication vulnerability
Use of Hard-coded Credentials vulnerability in Addi Addi – Cuotas que se adaptan a ti buy-now-pay-later-addi allows Password Recovery Exploitation.This issue affects Addi – Cuotas que se adaptan a ti: from n/a through = 2.0.4...
CVE-2026-27071
CVE-2026-27071 is a Missing Authorization / Broken Access Control vulnerability in the WordPress plugin WPCafe (wp-cafe) by Arraytics, affecting versions up to 3.0.7. The issue enables exploitation of incorrectly configured access control. CVSS v3.1 base score 9.1 (critical); vector: NETWORK, PR:...
CVE-2026-27073
CVE-2026-27073 is a WordPress plugin issue affecting Addi – Cuotas que se adaptan a ti, 2.0.4. The available connected sources do not provide explicit exploit details or in-the-wild activity beyond the vulnerability description and fixes. If you use this plugin, prioritize upgrading to a non-vul...
CVE-2026-27073 WordPress Addi – Cuotas que se adaptan a ti plugin <= 2.0.4 - Broken Authentication vulnerability
Use of Hard-coded Credentials vulnerability in Addi Addi Cuotas que se adaptan a ti buy-now-pay-later-addi allows Password Recovery Exploitation.This issue affects Addi Cuotas que se adaptan a ti: from n/a through = 2.0.4...
CVE-2026-27046 WordPress StoreCustomizer plugin <= 2.6.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kaira StoreCustomizer woocustomizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects StoreCustomizer: from n/a through = 2.6.3...
CVE-2026-27046
CVE-2026-27046: A Missing Authorization flaw in the StoreCustomizer plugin (StoreCustomizer – A plugin to Customize all WooCommerce Pages) affects WordPress installations using StoreCustomizer versions up to 2.6.3. The issue permits unauthenticated access due to misconfigured access controls, wit...
CVE-2026-27046 WordPress StoreCustomizer plugin <= 2.6.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kaira StoreCustomizer woocustomizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects StoreCustomizer: from n/a through = 2.6.3...
CVE-2026-25460 WordPress Ave Core plugin <= 2.9.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in LiquidThemes Ave Core ave-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ave Core: from n/a through = 2.9.1...
CVE-2026-25462 WordPress avalex plugin <= 3.1.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in avalex avalex avalex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects avalex: from n/a through = 3.1.3...
CVE-2026-25460 WordPress Ave Core plugin <= 2.9.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in LiquidThemes Ave Core ave-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ave Core: from n/a through = 2.9.1...
CVE-2026-25462
CVE-2026-25462 is a Missing Authorization vulnerability in the avalex plugin for WordPress. Affected software: avalex (WordPress plugin) versions up to and including 3.1.3. Root cause: improper access control allows unauthorized access to/through the plugin. Impact as reported: Medium severity (C...
CVE-2026-25462 WordPress avalex plugin <= 3.1.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in avalex avalex avalex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects avalex: from n/a through = 3.1.3...
CVE-2026-25460
CVE-2026-25460 affects Ave Core (Ave Core plugin) for WordPress, with a Missing Authorization flaw in ave-core that permits exploitation due to incorrectly configured access control/security levels in Ave Core versions up to 2.9.1. The connected documents confirm the vendor/product (Ave Core) and...
CVE-2026-25454
CVE-2026-25454 is a Missing Authorization vulnerability affecting The League WordPress Theme (the-league) up to version 4.4.1. The initial description notes Missing Authorization with an impact described as an access-control misconfiguration, affecting The League from not applicable to <= 4.4....
CVE-2026-25456 WordPress Automated FedEx live/manual rates with shipping labels plugin <= 5.1.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in Aarsiv Groups Automated FedEx live/manual rates with shipping labels a2z-fedex-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automated FedEx live/manual rates with shipping labels: from n/a through = 5.1....
CVE-2026-25455
CVE-2026-25455 is a Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce (woocommerce-products-slider). Affected versions cover Product Slider for WooCommerce up to 1.13.61. The issue arises from incorrectly configured access control, enabling unauthorized access to a...
CVE-2026-25454 WordPress The League theme <= 4.4.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in MVPThemes The League the-league allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The League: from n/a through = 4.4.1...
CVE-2026-25456 WordPress Automated FedEx live/manual rates with shipping labels plugin <= 5.1.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in Aarsiv Groups Automated FedEx live/manual rates with shipping labels a2z-fedex-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automated FedEx live/manual rates with shipping labels: from n/a through = 5.1....
CVE-2026-25454 WordPress The League theme <= 4.4.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in MVPThemes The League the-league allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The League: from n/a through = 4.4.1...