CVE-2026-110366

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.4...

CVE-2026-19798 WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints

The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setstatus and bulk functions in the MapsController REST controller in versions up to, and including, 3.0.0. The plugin's permissioncallback canedit only verifies...

CVE-2026-19798

The WP Map Block plugin for WordPress (versions up to and including 3.0.0 ) is vulnerable to unauthorized data modification due to a missing capability check in the Maps_Controller REST controller. Specifically, the set_status() and bulk() functions lack object-level ownership checks or publish-l...

CVE-2026-109982 MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently delete...

CVE-2026-109982

The MB Custom Post Types & Custom Taxonomies WordPress plugin (versions before 2.12.2 ) is vulnerable to a missing authorization and nonce validation flaw in its migration actions. This allows any authenticated user , including those with low-level privileges like subscribers , to trigger a one-w...

WordPress MB Custom Post Types & Custom Taxonomies plugin < 2.12.2 - Subscriber+ Missing Authorization vulnerability

Subscriber+ Missing Authorization vulnerability discovered by Naoki Kawahigashi in WordPress Plugin MB Custom Post Types & Custom Taxonomies versions 2.12.2...

CVE-2026-105973

The Visual Form Builder WordPress plugin (versions

CVE-2026-105973 Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user Subscriber and above to alter the field structure of any form on the site, persistently breaking its public rendering...

agency-toolkit-1023-missing-authorization-to-unauthenticated-arbitrary-options-update

NoCVE Agency Toolkit = 1.0.23 - Missing Authorization to Unauthenticated Arbitrary Options Update Description The Agency Toolkit plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the...

js-jobs

js-jobs JS Job Manager To activate a plugin there is a limitation here, as the plugin must have the /.php file, otherwi...

freemius-exploit

freemius-exploit Freemius Library 2.2.4 - Subscriber+ Arbitrary Option Update Description The library, used in numerous plugins, does not have proper authorization when updating blog options, allowing any authenticated users, such as a subscriber, to update arbitrary options. Usage usage:...

CVE-2024-12558

CVE-2024-12558 WP BASE Booking of Appointments, Services and Events history.pushState'', '', '/'; document.forms0.submit;...

CVE-2026-110721

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback = 'returntrue', and the handler at...

CVE-2024-11423

CVE-2024-11423 Ultimate Gift Cards for WooCommerce = 3.0.6 - Missing Authorization to Infinite Money Glitch Description The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and U...

EUVD-2026-102642

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback = 'returntrue', and the handler at...

CVE-2026-109812

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the...

CVE-2026-109812 Missing Authorization on Secret Endpoints

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the...

EUVD-2026-102593

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the...

CVE-2026-109812

Some of Moxa's industrial computing products are susceptible to a missing authorization vulnerability in the internal API /api/v1/secrets/. A low-privileged authenticated attacker with adjacent network access can exploit this flaw to access sensitive information, which may lead to the disclosure ...

EUVD-2026-102497

Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...