CVE-2026-96756

Versions of orval prior to 8.30.0 are susceptible to a code injection vulnerability within the @orval/core factory generator. The root cause is a failure to properly escape date default values in new Date() calls. When the factoryMethods and useDates options are enabled, an attacker can inject ar...

CVE-2026-96756 orval before 8.30.0 Code Injection via Factory Generation

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

CVE-2026-96756 orval before 8.30.0 Code Injection via Factory Generation

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

CVE-2026-93508

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

CVE-2026-93507

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

CVE-2026-93508 WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

EUVD-2026-85060

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

WordPress WC Fields Factory plugin < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure vulnerability

Contributor+ Arbitrary Post Cloning and Private Content Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WC Fields Factory versions 4.1.11...

CVE-2026-93508

The WC Fields Factory WordPress plugin, in versions prior to 4.1.11 , is vulnerable to unauthorized access because it fails to properly restrict its field-management AJAX action . This flaw allows authenticated users with Subscriber-level access or higher to perform unauthorized actions, includin...

WordPress WC Fields Factory plugin < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation vulnerability

Subscriber+ Arbitrary Post Meta Manipulation vulnerability discovered by Farid Narimanov in WordPress Plugin WC Fields Factory versions 4.1.11...

CVE-2026-93507

The WC Fields Factory WordPress plugin (versions before 4.1.11 ) is vulnerable to an authorization bypass because it fails to properly restrict access to or verify a nonce for a post-cloning action. This flaw allows users with Contributor-level privileges and above to duplicate arbitrary posts, r...

EUVD-2026-85061

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

CVE-2026-93507 WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

CVE-2026-93508 WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

CVE-2026-93507 WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

PT-2026-97197

Name of the Vulnerable Software and Affected Versions WC Fields Factory WordPress plugin versions prior to 4.1.11 Description Insufficient access restrictions and missing nonce verification for a post-cloning action allow users with Contributor-level permissions or higher to duplicate arbitrary...

PT-2026-97198

Name of the Vulnerable Software and Affected Versions WC Fields Factory WordPress plugin versions prior to 4.1.11 Description Insufficient access restrictions on the field-management AJAX action allow authenticated users with Subscriber-level permissions or higher to create, modify, and delete...

CVE-2026-93508: Missing Authorization

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

CVE-2026-96756: Improper Control of Generation of Code

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

CVE-2026-93507: Missing Authorization

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...