CVE-2026-11867: Missing Authorization

The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges such as Subscribers to create, rename, and delete arbitrary taxonomy terms...

CVE-2026-14270

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the ecosavesettings function, which allows...

EUVD-2026-50296

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the ecosavesettings function, which allows...

CVE-2026-14488

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

Security update for PackageKit

This update for PackageKit fixes the following issue: CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Special Instructions and Notes: Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for PackageKit

This update for PackageKit fixes the following issues: CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Special Instructions and Notes: Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaS...

SUSE-SU-2026:3404-1 Security update for PackageKit

This update for PackageKit fixes the following issues: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250...

CVE-2026-14488

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

CVE-2026-14488 Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

CVE-2026-14488

CVE-2026-14488 affects the Meta Box AIO WordPress plugin (MB Frontend Submission extension) up to version 3.8.0. The vulnerability stems from handle_request() routing the mbfs_delete action without capability/ownership checks, and nonce verification in check_ajax() being gated behind is_ajax(), w...

EUVD-2026-50274

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

CVE-2026-14488: Missing Authorization

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

PT-2026-65784

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco save settings function, which allows...

PT-2026-65769

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle request function routing the mbfs delete action without any capability or...

CVE-2026-13110

The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogocategorymsgcreate AJAX handler, which is registered for both authenticated wpajax and unauthenticated wpajaxnopriv...

Frontend Uploader <= 0.9.2 - Cross-Site Scripting Detection

The Frontend Uploader WordPress plugin prior to v.0.9.2 was affected by an unauthenticated Cross-Site Scripting security vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The Frontend Uploader WordPress plugin prior to v.""" from kittysploit import from lib.protocols.http.httpclient...

Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect Detection

The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requestedpage' POST parameter in the verifyusernamepassword function. This makes it possible for unauthenticated...

Google frontend HttpServer Detection

Detects Google frontend HttpServer. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Google frontend HttpServer.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Google frontend HttpServer Detection', 'description...

LogRocket RUM - Detect

Detects LogRocket Session Replay & Frontend Monitoring artifacts. !/usr/bin/env python3 -- coding: utf-8 -- """Detects LogRocket Session Replay & Frontend Monitoring artifacts.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

CVE-2026-14545

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...