CVE-2026-110070: Authorization Bypass Through User-Controlled Key

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types...

PT-2026-93762

Name of the Vulnerable Software and Affected Versions Blog2Social plugin for WordPress versions prior to 9.1.0 Description Low-privileged accounts can access the email addresses of all registered WordPress users. The issue occurs because the b2s search user AJAX handler in includes/Ajax/Get.php...

EUVD-2025-210644

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

CVE-2025-15674

Passster (WordPress plugin) before 4.3.7 allows low-privilege users with edit_posts capability to read globally password-protected content via the WordPress REST API when global protection is enabled. Any Contributor or higher can access protected pages/posts without the password. A fix is availa...

CVE-2025-15674 Content Protector (Passster) < 4.3.7 - Contributor+ Protected Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

CVE-2025-15674 Content Protector (Passster) < 4.3.7 - Contributor+ Protected Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

EUVD-2026-53058

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

CVE-2026-15941

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

PT-2026-67944

Name of the Vulnerable Software and Affected Versions Relevanssi affected versions not specified Description The plugin includes an Admin Search page that enables users with the edit posts capability to perform searches from the WordPress dashboard. An AJAX handler accepts a URL-encoded args...

PT-2026-68632

Name of the Vulnerable Software and Affected Versions Passster versions prior to 4.3.7 Description Low-privilege users with the edit posts capability can read globally password-protected content through the WordPress core REST API when global protection is enabled. This allows any user with...

Improper Authorization

github.com/mattermost/mattermost-server is vulnerable to improper authorization. The vulnerability is due to failure in validating the relationship between the post being updated and the MSTeams plugin OAuth flow, which allows an attacker to exploit this via a crafted OAuth redirect URL to edit...

CVE-2026-0566

A security vulnerability has been detected in code-projects Content Management System 1.0. Impacted is an unknown function of the file /admin/editposts.php. The manipulation of the argument image leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-0566

A security vulnerability has been detected in code-projects Content Management System 1.0. Impacted is an unknown function of the file /admin/editposts.php. The manipulation of the argument image leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-0566

A security vulnerability has been detected in code-projects Content Management System 1.0. Impacted is an unknown function of the file /admin/editposts.php. The manipulation of the argument image leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-0566 code-projects Content Management System edit_posts.php unrestricted upload

A security vulnerability has been detected in code-projects Content Management System 1.0. Impacted is an unknown function of the file /admin/editposts.php. The manipulation of the argument image leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-0566 code-projects Content Management System edit_posts.php unrestricted upload

A security vulnerability has been detected in code-projects Content Management System 1.0. Impacted is an unknown function of the file /admin/editposts.php. The manipulation of the argument image leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-0566

CVE-2026-0566 affects code-projects Content Management System 1.0. The vulnerability lies in the /admin/edit_posts.php script where manipulating the image parameter enables unrestricted file uploads. Exploitation is possible remotely, and the exploit has been publicly disclosed. Public data show ...

PT-2026-1107

Name of the Vulnerable Software and Affected Versions code-projects Content Management System version 1.0 Description A security issue exists in code-projects Content Management System. The manipulation of the image argument in a file, /admin/edit posts.php, allows for unrestricted file upload...

CVE-2025-14163

The Premium Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.11.53. This is due to missing nonce validation in the 'insertinnertemplate' function. This makes it possible for unauthenticated attackers to create arbitrary...

CVE-2025-14288 Gallery Blocks with Lightbox <= 3.3.0 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification

The Gallery Blocks with Lightbox. Image Gallery, HTML5 video , YouTube, Vimeo Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to unauthorized modification of plugin settings in all versions up to, and including, 3.3.0. This is due to the plugin using the editposts...