CVE-2026-84168 Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...

EUVD-2026-85037

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...

CVE-2026-84168

The Easy Hide Login WordPress plugin, in versions prior to 1.7 , fails to fully enforce its hidden-login protection. This flaw allows an unauthenticated attacker to bypass the security measures by using specific password-reset request parameters to access the standard login page. Furthermore, the...

PT-2026-97173

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...

CVE-2026-84168: Exposure of Sensitive Information to an Unauthorized Actor

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...

CVE-2026-7527

The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially...

EUVD-2026-83555

The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially...

PT-2026-95791

Name of the Vulnerable Software and Affected Versions WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress versions prior to 7.0.03 Description An Open Redirect issue exists because the plugin fails to properly validate user input. Unauthenticated attackers can redirect users to...

CVE-2026-7527: URL Redirection to Untrusted Site

The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially...

CVE-2026-77875 Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storage

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable...

CVE-2026-77875 Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storage

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable...

CVE-2026-77875

Hide Photos – Secure vault (version 4.1.0 ) stores vault media and wallet records in shared external storage , where the data is not bound to the application's calculator-style passcode authentication boundary. A local actor with access to shared external storage—such as through an authorized non...

WordPress Hide My WP Ghost plugin 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass vulnerability

Unauthenticated Firewall, Threat Detection and URL Hiding Bypass vulnerability discovered by Kenny in WordPress Plugin Hide My WP Ghost versions 7.0.10...

WordPress Hide My WP Ghost plugin < 7.0.11 - Unauthenticated URL Hiding Bypass vulnerability

Unauthenticated URL Hiding Bypass vulnerability discovered by Animesh Gaurav in WordPress Plugin Hide My WP Ghost versions 7.0.11...

CVE-2026-86800

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...

CVE-2026-86796

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows...

CVE-2026-86800

The Hide My WP Ghost WordPress plugin prior to 7.0.11 fails to properly validate a loopback security-check request before disabling its login and URL hiding protection. Because the verification value is not correctly checked, any unauthenticated visitor can craft a request with a missing or incor...

EUVD-2026-82686

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...

CVE-2026-86800 WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...

CVE-2026-86796 WP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows...