EUVD-2026-85797

The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a...

EUVD-2026-85795

The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation...

CVE-2026-80338

The CMB2 WordPress plugin before version 2.13.0 is vulnerable to a flaw where it fails to perform capability checks on one of its AJAX actions . This allows users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, potentially breaking core site setti...

Malicious Package

Overview @wizloft/harness-plugin-memory-context is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious Package

Overview @wizloft/harness-plugin-file-events is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview @wizloft/harness-plugin-file-memory is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview eslint-plugin-i18n-shreddit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-88846: Missing Authorization

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites wher...

CVE-2026-88845: Missing Authorization

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own accoun...

CVE-2026-82850: Exposure of Sensitive Information to an Unauthorized Actor

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is appli...

CVE-2026-15731: Improper Neutralization of Input During Web Page Generation

The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2026-89005: Improper Neutralization of Input During Web Page Generation

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session ...

CVE-2026-88847: Missing Authorization

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to...

CVE-2026-88843: Improper Limitation of a Pathname to a Restricted Directory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...

CVE-2026-80513: Deserialization of Untrusted Data

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

CVE-2026-61782: Exposure of Sensitive Information to an Unauthorized Actor

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

...[ More ]

Apache BuildStream's tar source plugin extracts archives without safely resolving symbolic links link following. A malicious source tarball can include a symlink entry that points outside the staging directory and then a file entry that writes through it, so a crafted upstream source can create o...

PT-2026-98195

Name of the Vulnerable Software and Affected Versions @rsdoctor/rspack-plugin versions prior to 1.5.16 Description The default report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint without authentication and with...

PT-2026-97720

Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.4.5 Description An issue exists in the Events Manager WordPress plugin where the scope of logged-in event and location searches is not enforced when a user provides a custom owner value. This allows a...

PT-2026-97714

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description The plugin fails to verify if user registration is enabled on the site before processing account creation through its front-end registration flows. This allows unauthenticat...