WordPress Tutor LMS plugin <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion via 'lessonid' Parameter vulnerability discovered by EUNHO KIM - Hyundai Autoever in WordPress Plugin Tutor LMS versions = 4.0.8...

WordPress Divi Essentials plugin <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Divi Essentials versions = 5.8.1...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure vulnerability

Missing Authorization to Authenticated Custom+ Chat-Room Transcript Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin BP Better Messages versions = 2.15.33...

CVE-2026-12739 WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

WordPress Filter Gallery plugin <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Gallery Deletion vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Filter Gallery versions = 1.1.4...

CVE-2026-91707 Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2026-18317 Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-89008

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...

CVE-2026-89007 Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...

CVE-2026-89007 Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...

CVE-2026-89007

The Bookit — Booking & Appointment Calendar WordPress plugin (versions before 2.6.0.5 ) is vulnerable to an authorization flaw. The plugin fails to perform a capability check within one of its appointment-deletion functions. This allows users assigned to the low-privileged custom Staff role to pe...

CVE-2026-89008 Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...

CVE-2026-89008

The Bookit — Booking & Appointment Calendar WordPress plugin, in versions prior to 2.6.0.5 , fails to perform adequate authorization checks on specific appointment-retrieval actions. This flaw allows users with low-privilege, plugin-specific roles to access and read the appointment records of oth...

EUVD-2026-82675

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

CVE-2026-84904

The King Addons for Elementor WordPress plugin (versions 51.1.56 through 51.1.80 ) contains an authorization flaw where it fails to perform per-object authorization checks on specific image-optimization actions. The plugin relies on coarse capabilities held by lower-privileged users without verif...

CVE-2026-84904 King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...

CVE-2026-84904 King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...

WordPress King Addons for Elementor plugin 51.1.56-51.1.80 - Author+ Missing Authorization vulnerability

Author+ Missing Authorization vulnerability discovered by Artus KG in WordPress Plugin King Addons for Elementor versions 51.1.56-51.1.80...

Chromium CVE-2026-91739: Missing authorization

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releaseshttps://chromereleases.googleblog.com/2026 for more information...

Chromium CVE-2026-91717: Missing authorization

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releaseshttps://chromereleases.googleblog.com/2026 for more information...