CLSA-2026-1792393379 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.16.7-tuxcare.3...

CLSA-2026-1792393376 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792393378 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.29.0-tuxcare.2...

CLSA-2026-1792393377 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CLSA-2026-1792393373 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

CLSA-2026-1792393374 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

CLSA-2026-1792393375 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

WordPress Choose User Role at Registration plugin < 1.3.3 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Choose User Role at Registration versions 1.3.3...

CVE-2026-94294 App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...

CVE-2026-94294

The App Builder WordPress plugin (versions 3.8.4 through 5.7.0) contains a vulnerability where the application fails to require authentication or authorization before writing attacker-supplied data to one of its options. In a separate unauthenticated request, the plugin redirects the visitor's br...

CVE-2026-94294 App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...

EUVD-2026-104107

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...

EUVD-2026-104106

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94272 Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94272

The Snap Finance WordPress plugin versions before 3.12.0 is vulnerable to an authentication bypass. The plugin fails to verify that requests to change a WooCommerce order's status originate from an authorized source. This allows unauthenticated attackers to manipulate order states, such as moving...

CVE-2026-94272 Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94231 TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices...

EUVD-2026-104105

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices...

CVE-2026-94230 TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer...

CVE-2026-94231

The TrueBooker WordPress plugin (versions 1.1.9 through 1.2.9 ) is vulnerable to an authorization bypass due to missing checks in specific functionalities. This flaw allows unauthenticated users to create and modify booking services and categories , which includes the ability to alter associated ...