CVE-2026-96525 MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...

CVE-2026-84095

The wp-review-slider-pro WordPress plugin (versions before 12.7.12 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of capability checks on an AJAX handler combined with a nonce that is generated for every visitor. This allows any authenticated user, such as a subsc...

CVE-2026-84096

The wp-review-slider-pro WordPress plugin, in versions prior to 12.7.12 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a missing capability check on the AJAX handler used to save review submission forms, combined with a nonce that is generated for every visitor. This all...

Missing Authorization

Overview @openclaw/diagnostics-prometheus is an OpenClaw diagnostics Prometheus exporter for runtime metrics. Affected versions of this package are vulnerable to Missing Authorization via the authenticated metrics endpoint, which does not enforce the operator.read scope. An authenticated caller...

Missing Authorization

Overview @openclaw/discord is an OpenClaw Discord channel plugin Affected versions of this package are vulnerable to Missing Authorization via the emoji and sticker upload actions, which drop the sender-scoped media policy before loading a local file. A sender permitted to invoke those actions ca...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the MCP loopback component, which fails to enforce the sandbox.tools.deny policy for sandboxed coding-agent sessions. An attacker operating within a sandboxed...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via improper enforcement of sender allowlists in multi-person direct messages group DMs. A disallowed participant present in a Slack group DM can trigger an OpenClaw...

Missing Authorization

Overview @openclaw/matrix is an OpenClaw Matrix channel plugin Affected versions of this package are vulnerable to Missing Authorization via caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions, which do not enforce the configured channel read...

Missing Authorization

Overview @openclaw/googlechat is an OpenClaw Google Chat channel plugin for spaces and direct messages. Affected versions of this package are vulnerable to Missing Authorization via caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions, which d...

Missing Authorization

Overview @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Missing Authorization via caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions, which do not enforce the configured...

Missing Authorization

Overview @openclaw/feishu is an OpenClaw Feishu/Lark channel plugin community maintained by @m1heng Affected versions of this package are vulnerable to Missing Authorization via caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions, which do no...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the Codex computer-use installation command, which fails to properly validate owner authorization. An authorized non-owner channel sender can install arbitrary...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the global Active Memory toggle mutations, which omit owner authorization checks. An authorized non-owner external-channel sender can persistently enable or...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the persistent /dreaming on and /dreaming off command handlers, which omit owner permission checks. An authorized but non-owner external-channel sender can issue...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the MCP channel bridge, which fails to enforce the owner-only authorization requirement for Claude Code permission prompts. An authorized non-owner channel sende...

Missing Authorization

Overview @openclaw/discord is an OpenClaw Discord channel plugin Affected versions of this package are vulnerable to Missing Authorization via guild metadata read actions, which fail to enforce the configured Discord read-target channel allowlist. A lower-trust sender or steered agent with access...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the /mcp set and /mcp unset chat commands, which fail to enforce owner-level authorization checks on non-owner external-channel senders. An authenticated non-own...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the /activation command handler, which fails to enforce the documented owner-only requirement for persistent activation policy changes in group channels. An...

CVE-2026-100591

OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for...

CVE-2026-100591

OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for...