CVE-2026-97305

The Themeisle AI Chatbot for WordPress – Hyve Lite plugin (versions

CVE-2026-103085

The WP User Manager plugin for WordPress (versions

EUVD-2026-92579

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14...

EUVD-2026-92581

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74...

CVE-2026-103085 WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...

CVE-2026-97304

The Arraytics Timetics WordPress plugin (versions

CVE-2026-97304 WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63...

CVE-2026-103086

The UsersWP WordPress plugin (versions up to and including 1.2.74 ) contains a Missing Authorization vulnerability. This flaw allows for the exploitation of incorrectly configured access control security levels , potentially leading to an integrity impact as indicated by the CVSS 3.1 vector. No s...

CVE-2026-102383 WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14...

EUVD-2026-92584

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63...

CVE-2026-97304 WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63...

CVE-2026-102383

The VillaTheme Lookzy WordPress plugin (versions

CVE-2026-103085 WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...

CVE-2026-102383 WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14...

EUVD-2026-92582

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...

CVE-2026-103086 WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74...

CVE-2026-103086 WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74...

EUVD-2026-92547

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

CVE-2026-105632 Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

CVE-2026-105632 Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...