10266 matches found
CVE-2026-16540
The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently dele...
EUVD-2026-51942
The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds...
CVE-2026-16042
The CVE-2026-16042 entry concerns the LWS Optimize WordPress plugin before version 3.4. The underlying issue is a missing capability check on cache-clearing actions, which allows any authenticated user, including Subscribers, to flush site caches and trigger repeated cache rebuilds. Documented im...
CVE-2026-16042 LWS Optimize < 3.4 - Subscriber+ Cache Deletion
The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds...
CVE-2026-15385 RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...
CVE-2026-16256
The CVE-2026-16256 entry concerns the POUCO Import Users WordPress plugin (
CVE-2026-15385
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...
CVE-2026-15385
Affected software: RT Mega Menu WordPress plugin (before 1.5.2). Vulnerability summary: Lack of a proper capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings. The only gate is a nonce readable by any logged-in user, allowing a subscriber-level user to ...
CVE-2026-11872
The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered ...
EUVD-2026-51936
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...
CVE-2026-15151
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...
EUVD-2026-51932
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...
PT-2026-67073
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...
CVE-2026-13329
The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...
CVE-2025-15669
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users such as administrators, who do not hold the unfilteredhtml capability on multisite to store JavaScript that...
EUVD-2026-51699
The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...
CVE-2026-13329
The CVE-2026-13329 entry concerns the Buckaroo Woocommerce Payments Plugin for WordPress, affecting versions before 4.9.0. The vulnerability arises because an AJAX action that processes payment capture refunds does not perform any capability checks or nonce validation, allowing any authenticated ...
CVE-2026-13329 WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund
The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...
EUVD-2025-210577
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users such as administrators, who do not hold the unfilteredhtml capability on multisite to store JavaScript that...
kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns
A flaw was found in the Linux kernel's rtnetlink component. An unprivileged local user, leveraging a user namespace, can exploit a missing CAPNETADMIN capability check in the rtnlnewlink function. This allows the user to create paired network devices in arbitrary network namespaces, including the...