CVE-2026-15361

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...

CVE-2026-14943

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

CVE-2026-15359 Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and...

CVE-2026-15361 Content Views < 4.5 - Subscriber+ SQL Injection via preview_request

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...

EUVD-2026-54383

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...

CVE-2026-15361

The CVE relates to the Content Views WordPress plugin prior to version 4.5. It does not perform a required capability check on one of its AJAX actions and fails to sanitize attacker-supplied data before using it in a SQL query. This combination allows any authenticated user, including Subscribers...

CVE-2026-14943

The affected product is the WordPress plugin “Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content” (pre-2.8.4). The vulnerability is an unauthenticated REST API exposure: when a specific option is enabled, unauthenticated users can access REST endpoints to read co...

CVE-2026-14943 Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

EUVD-2026-54377

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

EUVD-2026-54181

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker...

EUVD-2026-54306

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content...

EUVD-2025-210644

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

CVE-2026-71435

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, the default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the...

CVE-2026-64662

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished...

CVE-2026-64663

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation...

UBUNTU-CVE-2026-64654

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

CVE-2026-45572

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCellhtmlconten...

CVE-2026-18487

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

CVE-2026-14306

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content...

CVE-2026-11361

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership...