CVE-2026-75905: Missing Authorization

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-19778: Improper Neutralization of Special Elements used in an SQL Command

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-82185: Missing Authorization

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...

CVE-2026-19946: Missing Authorization

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpasdomrdenyuser function, which unlike its counterpart wpasdomractivateuser does not enforce currentusercan'editusers' or...

CVE-2026-19802: Missing Authorization

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-75966: Improper Neutralization of Input During Web Page Generation

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episodecontributor....comment' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-17149: Improper Neutralization of Input During Web Page Generation

The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output...

CVE-2026-19800: Improper Neutralization of Special Elements used in an SQL Command

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-15398: Missing Authorization

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-13709: Improper Neutralization of Input During Web Page Generation

The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iqtreetreecharttemplate' Widget Setting in all versions up to, and including, 3.1.11 due to insufficient input sanitization and output escaping. This makes it possible for...

Aegis aegis-v0.14.1-alpha

AEGIS is a desktop app for monitoring local AI agents and reviewing their files and selected actions. Inspect processes, sensitive-file observations, TCP endpoints and attribution evidence in Observatory. Monitoring requires no agent plugin; policy-controlled execution and MCP action tools requir...

CVE-2026-78455

creationtimestamp| type| source ---|---|--- 2026-09-08 22:09:19+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:08:15+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 10:50:01+00:00|...

CVE-2026-72949

creationtimestamp| type| source ---|---|--- 2026-09-08 22:08:24+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:07:08+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 10:21:08+00:00|...

CVE-2026-69460

creationtimestamp| type| source ---|---|--- 2026-09-08 22:06:57+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:06:14+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:20:19+00:00|...

CVE-2026-69587

creationtimestamp| type| source ---|---|--- 2026-09-08 22:06:40+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:05:54+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 10:19:00+00:00|...

CVE-2026-83972

creationtimestamp| type| source ---|---|--- 2026-09-08 22:04:54+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:04:40+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 10:48:04+00:00|...

CVE-2026-69305

creationtimestamp| type| source ---|---|--- 2026-09-08 22:03:40+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:03:32+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 08:49:38+00:00|...

CVE-2026-80090

creationtimestamp| type| source ---|---|--- 2026-09-08 22:02:53+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:02:43+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 10:55:13+00:00|...

CVE-2026-72977

creationtimestamp| type| source ---|---|--- 2026-09-08 22:02:36+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:02:29+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 10:25:46+00:00|...

CVE-2026-68852

creationtimestamp| type| source ---|---|--- 2026-09-08 22:02:07+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:01:57+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 08:55:00+00:00|...