PT-2026-81964

The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken...

PT-2026-82109

Name of the Vulnerable Software and Affected Versions Starlette-Admin versions prior to 0.16.1 Description An authenticated user with access to a list endpoint can bypass administrative interface restrictions by submitting arbitrary field names to the starlette admin/base.py and BaseModelView...

CVE-2026-77693: External Control of File Name or Path

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...

CVE-2026-46371: Improper Neutralization of Special Elements used in an SQL Command

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

CVE-2026-46370: Improper Neutralization of Special Elements used in an SQL Command

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

WordPress All-in-One WP Migration and Backup plugin <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability

Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability discovered by Jack Taylor in WordPress Plugin All-in-One WP Migration versions = 7.109...

GO-2026-6269 Fleet: ORDER BY column injection on activity list endpoints in github.com/fleetdm/fleet

Fleet: ORDER BY column injection on activity list endpoints in github.com/fleetdm/fleet...

WordPress WP Crowdfunding plugin < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR vulnerability

Subscriber+ Order Data Disclosure via IDOR vulnerability discovered by Sajjad Haqi in WordPress Plugin WP Crowdfunding versions 2.2.1...

WordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR vulnerability

Unauthenticated Order Receipt Tampering via IDOR vulnerability discovered by Lyris Vale in WordPress Plugin PeproDev WooCommerce Receipt Uploader versions = 2.8.0...

WordPress f4 Post Tree plugin < 2.0.5 - Subscriber+ Arbitrary Post Parent/Menu Order Modification vulnerability

Subscriber+ Arbitrary Post Parent/Menu Order Modification vulnerability discovered by Mustafa Ahmed in WordPress Plugin F4 Post Tree versions 2.0.5...

CVE-2026-19949

The All-in-One WP Migration and Backup WordPress plugin (all versions up to and including 7.109 ) is susceptible to a second-order SQL injection in its archive restore functionality, caused by insufficient escaping of a user-supplied parameter and inadequate preparation of the existing SQL query....

CVE-2026-19949 All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-19949 All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

Malicious code in css-import-order (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4 package.json declares the package's own name css-import-order as both a dependency and devDependency pointing at...

MAL-2026-14473 Malicious code in css-import-order (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4 package.json declares the package's own name css-import-order as both a dependency and devDependency pointing at...

CVE-2026-15023

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'metakey' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-15023 Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'metakey' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-65194

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'metakey' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-15023 Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'metakey' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-15023

The Events Manager WordPress plugin (versions up to and including 7.4.0 ) is vulnerable to a second-order SQL injection via the stored meta_key field in the Event/Location Duplicate action. An attacker with contributor-level or higher access plants SQL metacharacters into a custom meta key throug...