CVE-2026-13169

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

CVE-2026-19416 KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments...

CVE-2026-19417 KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...

CVE-2026-19416

KiviCare WordPress plugin before 4.5.4 lacks ownership checks on appointment modification endpoints, enabling authenticated patient-level users to cancel or reschedule other patients' appointments via IDOR. CVSS 3.1 base score 4.3 (Medium). Patch by upgrading to version 4.5.4 or later. No active ...

CVE-2026-19417

KiviCare WordPress plugin before 4.5.4 serves media files without verifying the requesting user's entitlement, enabling authenticated patient-level users to download any media library file including other patients' medical reports via an IDOR vulnerability; upgrade to 4.5.4. No active exploitatio...

CVE-2026-14861 User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-14861 User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

CVE-2026-14861

The User Verification by PickPlugins WordPress plugin (through 2.0.47) is vulnerable to an unauthenticated IDOR: the resend-verification-email endpoint fails to authorize the requesting user or bind the protecting token to that user, allowing attackers to reset email-verification status and lock ...

CVE-2026-16058

The YayCurrency WordPress plugin before 3.3.5 contains an unauthenticated information disclosure vulnerability in its multi-vendor integration handlers (specifically the Dokan integration). The root cause is the absence of capability or ownership checks on these handlers, which are reachable with...

EUVD-2026-62269

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and...

CVE-2026-14825

Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 lacks per-object ownership checks on front-end text settings, allowing contributor+ users to modify quizzes owned by others via IDOR. CVSS 2.7 LOW; no exploitation observed. Upgrade to 11.2.4. https://wpscan.com/vulnerability/fb66cb33-e1...

CVE-2026-14826

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 lacks per-object ownership checks on REST routes, allowing contributor-level users to read other users' quiz notification recipient addresses via IDOR. Exploitation details are not provided. Upgrade to QSM 11.2.4 to remediate.

CVE-2026-14826 Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

CVE-2026-14825 Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

CVE-2026-14196

The WCFM Marketplace WordPress plugin before 3.8.1 contains an IDOR flaw: it fails to verify review ownership, so any authenticated store vendor can unapprove or permanently delete reviews belonging to other vendors' stores. Exploitation requires low privileges (PR:L), network access, and no user...

CVE-2026-14196 WCFM Marketplace < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDOR

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores...

CVE-2026-14825 Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

CVE-2026-13175

The Eventin WordPress plugin before 4.1.21 suffers from an IDOR flaw: schedule records are modified or deleted without ownership checks, allowing contributor-level users to alter or remove other users' entries. CVSS 6.5 (MEDIUM) rates this as network-exploitable with high privileges required. No ...

EUVD-2026-62258

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

CVE-2026-13169

The Eventin WordPress plugin before 4.1.21 suffers from an IDOR flaw: contributor-level users can modify, delete, or reassign events created by others, including administrators, due to missing ownership verification. This grants unauthorized integrity and confidentiality control over event data. ...