33 matches found
CVE-2026-18037
The Create WordPress plugin (by Mediavine) versions prior to 2.5.4 is vulnerable to an authorization bypass. The root cause is a missing authorization check on a public REST API route , which allows unauthenticated attackers to read unpublished content . Furthermore, accessing this route triggers...
CVE-2026-18037 Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication
The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to mak...
CVE-2026-65490
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0...
CVE-2026-24552
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3...
CVE-2026-65490
Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...
EUVD-2026-48101
Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...
CVE-2026-24552
CVE-2026-24552 concerns the WordPress plugin “Create by Mediavine” (versions
EUVD-2026-48144
Contributor SQL Injection in Create by Mediavine = 2.5.3 versions...
PT-2026-63911
Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...
CVE-2026-65490: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0...
PT-2026-63802
Name of the Vulnerable Software and Affected Versions Create by Mediavine versions prior to 2.5.4 Description An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, specifically affecting users with contributor...
CVE-2025-62893
Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create by Mediavine: from n/a through = 1.9.14...
EUVD-2025-36045
Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create by Mediavine: from n/a through = 1.9.14...
CVE-2025-62893
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-62893
...
CVE-2025-62893
CVE-2025-62893 (mode C): The connected Red Hat and EUVD/EUV sources describe an Authorization Bypass Through a User-Controlled Key in the Mediavine Create by Mediavine mediavine-create plugin. The affected version range is from n/a through 1.9.14. The root cause is a misconfigured access control ...
PT-2025-43772
Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create by Mediavine: from n/a through = 1.9.14...