CVE-2026-15385

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...

PT-2026-48698

Name of the Vulnerable Software and Affected Versions Fediverse Embeds versions prior to 1.5.9 Description The software registers an unauthenticated AJAX action wp ajax nopriv ftf get site info located in includes/Site Info.php that processes a URL provided by the user via the $site url variable...