CVE-2026-110983

The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page...

CVE-2026-110983 WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF

The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page...

EUVD-2026-112624

The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page...

CVE-2026-110983

The WP Photo Album Plus WordPress plugin (versions before 9.3.04.004 ) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The software fails to verify the origin or a security token for specific comment-management requests. An attacker can exploit this by tricking a logged-in user with co...

CVE-2026-64969 Insecure Direct Object Reference in ATutor

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

PT-2026-3574

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 3.9.5 Description The Tutor LMS plugin for WordPress allows authenticated attackers with subscriber-level access or higher to delete arbitrary attachments on a site. This is due to a missing capability check within...

PT-2020-19496 · Qdpm · Qdpm

Name of the Vulnerable Software and Affected Versions: qdPM versions 9.1 and earlier Description: A remote code execution issue exists, allowing an attacker to upload malicious PHP code via the profile photo functionality. This is possible due to a path traversal vulnerability in the users'photop...