CVE-2026-57377

CVE-2026-57377 describes a missing authorization vulnerability in the WordPress WowAddons plugin (product-addons) affecting versions up to 1.6.8. The underlying issue is broken access control, i.e., incorrectly configured access control security levels, which can allow unauthorized actions. The v...

CVE-2026-57390

The CVE concerns the WordPress plugin “Extra Product Options Builder for WooCommerce” (also listed as additional-product-fields-for-woocommerce). A Missing Authorization/Broken Access Control vulnerability affects the plugin in versions up to and including 1.2.167, enabling exploitation due to in...

CVE-2026-15541

A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master Websocket Handler. Executing a manipulation of the argument Agent can lead to missing authorization. It is possible to launch...

MINI-V52Q-WVM9-QC87

Bulletin has no description...

MINI-2GQ9-2GPP-9FPH

Bulletin has no description...

MINI-Q6HC-7WVF-33JM

Bulletin has no description...

MINI-PMHC-WC82-RQ3G

Bulletin has no description...

MINI-35V2-5WW8-VV68

Bulletin has no description...

MINI-WF3X-MC59-99RH

Bulletin has no description...

MINI-FMM4-79C4-4QH7

Bulletin has no description...

MINI-M97M-FVRC-JWXJ

Bulletin has no description...

MINI-3GVH-FC3X-H9C5

Bulletin has no description...

MINI-G669-GJXC-X829

Bulletin has no description...

MINI-X4GW-P626-8HXG

Bulletin has no description...

MINI-F2GV-XM73-X9WR

Bulletin has no description...

MINI-QJGJ-36VP-M678

Bulletin has no description...

MINI-GWVG-F7JQ-2R8X

Bulletin has no description...

MINI-F363-F2H4-2HVW

Bulletin has no description...

CVE-2026-12396

The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level self-registerable account to approve, feature, or reject arbitrary jobs, including those owned by other user...

CVE-2026-12273

The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments...