CVE-2026-13177 Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

EUVD-2026-57073

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses...

CVE-2026-13168

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses...

PT-2026-71000

Name of the Vulnerable Software and Affected Versions Eventin WordPress plugin versions prior to 4.1.20 Description Insufficient access restrictions to individual order records allow users with contributor-level permissions or higher to access other customers' order data, including personal...

PT-2026-71006

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...

CVE-2026-14206

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data name, email, phone, address stored in form drafts...

CVE-2026-17020 Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

CVE-2026-14206 HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data name, email, phone, address stored in form drafts...

CVE-2026-14206 HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data name, email, phone, address stored in form drafts...

CVE-2026-14206

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data name, email, phone, address stored in form drafts...

CVE-2026-14206

The HT Contact Form WordPress plugin versions before 2.9.3 is vulnerable to an unauthenticated saved form draft data disclosure . The root cause is a lack of authorization checks on the specific endpoint responsible for returning saved form drafts. This allows unauthenticated users to access and ...

PT-2026-69340

Name of the Vulnerable Software and Affected Versions HT Contact Form WordPress plugin versions prior to 2.9.3 Description An authorization bypass exists in the endpoint that returns saved form drafts. This allows unauthenticated users to access and read personal data stored within these drafts,...

PT-2026-69350

Name of the Vulnerable Software and Affected Versions MotoPress Hotel Booking WordPress plugin versions prior to 6.2.3 Description An issue exists where the software fails to verify record ownership before updating customer records. This allows any authenticated user with low-privileged...

CVE-2026-14211: Authorization Bypass Through User-Controlled Key

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...

CVE-2026-17020: Authorization Bypass Through User-Controlled Key

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

PT-2026-69341

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions prior to 9.7 Description An issue exists where the plugin fails to verify if an authenticated employee provider is associated with the customer record being accessed. This allows any user...

CVE-2026-46409

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1: commonly 19141 without server-side Origin validation, loopback authentication, or Content-Type...

CVE-2026-47364

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

CVE-2026-16039

The MStore API WordPress plugin, in versions prior to 4.21.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to restrict its vendor-orders endpoint to the caller's own records, which allows any authenticated user—including those with Subscriber privileges—to view ...

CVE-2025-13909

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...