EUVD-2026-66869

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to inject...

EUVD-2026-66868

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...

CVE-2026-13415

The CMP WordPress plugin before version 4.1.18 fails to enforce an option-name allow-list when importing settings via one of its AJAX actions. This allows users with the Editor role —when an administrator has granted that role access to the plugin's admin-bar controls—to update arbitrary WordPres...

CVE-2026-13416

CVE-2026-13416 is a stored XSS vulnerability in the CMP WordPress plugin prior to version 4.1.18 . The plugin fails to sanitize and escape a settings value before rendering it on the coming-soon page . This allows any user with the Editor role — provided the administrator has granted that role ac...

CVE-2026-72585-PoC

CVE-2026-72585 — Grafana: Correzione incompleta di CVE-2026-21724 consente al ruolo Editor di eliminare i contact point protetti Prodotto: Grafana Grafana Labs — fino alla 13.2.0 File: pkg/services/ngalert/provisioning/contactpoints.go CWE: CWE-284 — Controllo degli accessi improprio CVSS 3.1:...

CVE-2026-14601

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

EUVD-2026-63816

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

CVE-2026-14601

The Link Whisper Free WordPress plugin before 0.9.7 contains a SQL injection vulnerability caused by improper sanitization and escaping of the domain parameter before it is used in a SQL query. Authenticated users with the Editor role or above can exploit this to execute arbitrary SQL commands, r...

CVE-2026-14601 Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

CVE-2026-74992 Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload

The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored X...

EUVD-2026-63206

The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored X...

CVE-2026-72585

An authorization bypass in Grafana allows Editor-role users to delete protected contact points because a previous security patch for updating them missed the deletion process. Mitigation To mitigate this issue grant the Editor role only to trusted users and restrict access to the Grafana UI/API t...

Linux Distros Unpatched Vulnerability : CVE-2026-72585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required...

CVE-2026-72585

Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid...

CVE-2026-72585

An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...

UBUNTU-CVE-2026-72585

An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...

CVE-2026-72585

...

CVE-2026-72585

Summary: CVE-2026-72585 affects Grafana up to version 13.2.0. An Editor-role user can delete protected contact points (receivers) because the DELETE path in receiver services was not updated with the protected-field check, even though CVE-2026-21724’s fix addressed only the UPDATE code path in th...

CVE-2026-72585 Grafana - Incomplete Fix for CVE-2026-21724 Allows Editor Role to Delete Protected Contact Points

An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...

CVE-2026-72585

An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...