CVE-2026-76607

Fabrik , a Joomla extension by fabrikar.com, is vulnerable to a missing ACL (Access Control List) check in its download element in versions prior to 4.7.3 . This flaw allows unauthenticated remote attackers to access download functionality without proper authorization, leading to high impact on c...

CVE-2026-76609 Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

CVE-2026-76608

Fabrik is a Joomla extension that provides form and database functionality. In versions prior to 4.7.2 , the onGetEmail endpoint lacked any access control checks, allowing an unauthenticated attacker to disclose the email address of any commenter. This constitutes an information disclosure vulner...

EUVD-2026-64335

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...

EUVD-2026-64298

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

CVE-2026-5093

The GreenShift – Animation and Page Builder Blocks plugin for WordPress (versions up to and including 12.8.9 ) is vulnerable to unauthorized modification of data due to a missing capability check on the gspb_update_global_wp_settings function. The function only verifies the edit_posts capability ...

CVE-2026-5093 Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

CVE-2026-5093 Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

CVE-2026-58001

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

CVE-2026-4244

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...

EUVD-2026-64275

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...

CVE-2026-4244 Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...

CVE-2026-4244 Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...

CVE-2026-58003 WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanentl...

CVE-2026-58003

WWBN AVideo through commit 9c39d8c8 is affected by a cross-site request forgery (CSRF) vulnerability in the releaseVideoNow.json.php endpoint. The endpoint lacks authenticity checks and accepts GET requests , allowing an attacker to craft a malicious cross-site GET request carrying an administrat...

EUVD-2026-64251

The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicatepostpermissions permission callback only verifying the duplicateposts capability without checking whether the requesting user holds publishposts...

CVE-2026-4245 Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication

The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicatepostpermissions permission callback only verifying the duplicateposts capability without checking whether the requesting user holds publishposts...

CVE-2026-77001

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user,...

CVE-2026-14187

The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...

CVE-2026-76789 Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...