CVE-2026-16064

The CVE-2026-16064 entry concerns the Event Booking Manager for WooCommerce WordPress plugin (pre-5.3.7). The root cause is improper authorization verification on objects during quick-edit operations, where the plugin checks only a global capability instead of per-object permissions. This allows ...

CVE-2026-4057

The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the makeMediaPublic and makeMediaPrivate functions in all versions up to, and including, 3.3.51. This is due to the functions only checking for editposts capability...