EUVD-2025-210981

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys Pixabay, Unsplash, Pixels, OpenAI configured by site...

CVE-2025-14486

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion in all versions up to and including 1.0.2 . The root cause is missing authorization checks , which allow unauthenticated attackers to delete arbitrary API keys (including Pixabay , Unsplash , Pixels , and OpenAI ) c...

CVE-2025-14486 PixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys Pixabay, Unsplash, Pixels, OpenAI configured by site...

CVE-2025-14484 Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

EUVD-2025-210982

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

CVE-2025-14484 Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

CVE-2025-14486 PixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys Pixabay, Unsplash, Pixels, OpenAI configured by site...

CVE-2025-14484

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification in all versions up to and including 1.0.3 . The root cause is missing authorization checks , which allows unauthenticated attackers to modify arbitrary API keys for Pixabay , Unsplash , and Pixels . Attackers c...

PT-2026-96658

Name of the Vulnerable Software and Affected Versions Handily plugin for WordPress versions prior to 1.0.4 Description Missing authorization checks allow unauthenticated attackers to modify Stripe payment configuration settings. By manipulating payment settings parameters, an attacker can change...

CVE-2025-14487: Missing Authorization

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable...

PT-2026-96664

Name of the Vulnerable Software and Affected Versions RW Elephant Rental Inventory versions prior to 2.3.14 Description The plugin contains a missing authorization flaw. The toggle cache function, which is linked to the wp ajax toggle cache AJAX action, does not perform a capability check or nonc...

PT-2026-96657

Name of the Vulnerable Software and Affected Versions PixelPlay versions prior to 1.0.3 Description The PixelPlay plugin for WordPress contains a flaw where authorization checks are missing, allowing unauthenticated attackers to delete API keys configured by site administrators. This is achieved ...

CVE-2026-93341: Missing Authorization

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingsendrefund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers...

CVE-2026-63104: Missing Authorization

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2026-93343: Missing Authorization

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingadminvendorsajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted AJAX request...

CVE-2026-75607: Missing Authorization

Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware...

CVE-2026-94384: Missing Authorization

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...

CVE-2026-18132: Missing Authorization

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization...

PT-2026-96656

Name of the Vulnerable Software and Affected Versions Image Buzz versions prior to 1.0.4 Description The Image Buzz plugin for WordPress contains missing authorization checks, allowing unauthenticated attackers to modify API keys configured by site administrators. This is achieved by manipulating...

PT-2026-96760

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking get page content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary...