CVE-2026-78275

This Arbitrary File Deletion vulnerability affects the WordPress Fluent Boards Pro plugin in versions ≤ 2.0.11 . The flaw requires an authenticated user with Editor privileges and is scored CVSS 6.8 (Medium) with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, indicating a high availability impa...

CVE-2026-78275 WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability

Editor Arbitrary File Deletion in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78274 WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability

Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...

EUVD-2026-66937

Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78274

CVE-2026-78274 affects the WordPress Fluent Boards Pro plugin in versions

EUVD-2026-66935

Editor Privilege Escalation in FluentCRM Pro = 3.1.12 versions...

CVE-2026-78271

CVE-2026-78271 is an Editor Privilege Escalation vulnerability in the WordPress FluentCRM Pro plugin, affecting versions 3.1.12 and earlier . The flaw was discovered by Ananda Dhakal via Patchstack. It allows an authenticated user with the Editor role to escalate privileges, rated CVSS 7.2 (HIGH)...

CVE-2026-78271 WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability

Editor Privilege Escalation in FluentCRM Pro = 3.1.12 versions...

WordPress AI Engine plugin < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability

Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.4...

CVE-2026-13415

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...

CVE-2026-13416

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to inject...

EUVD-2026-66868

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...

WordPress CMP plugin < 4.1.18 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.18...

EUVD-2026-66869

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to inject...

CVE-2026-13415 CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...

CVE-2026-13416 CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to inject...

CVE-2026-13415

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.18 fails to enforce an option-name allow-list when importing settings via its cmp_ajax_import_settings AJAX action. This allows users with the Editor role (when granted access to the plugin's admin-bar controls) to update arbitrary W...

CVE-2026-13416

CVE-2026-13416 is a stored XSS in the CMP – Coming Soon & Maintenance WordPress plugin (versions

EUVD-2026-66766

LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5...

Linux Distros Unpatched Vulnerability : CVE-2026-77652

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer...