CVE-2026-15407 Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-4338

The ActivityPub WordPress plugin (versions before 8.0.2 ) is vulnerable to an unauthenticated drafts/scheduled/pending posts disclosure vulnerability. The root cause is a failure to properly filter posts before they are displayed, which allows unauthenticated users to access internal content such...