EUVD-2026-103251

The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request CSRF, taking over the site's Patreon integration...

EUVD-2026-103252

The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end...

CVE-2026-107744

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...

EUVD-2026-103230

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...

CVE-2026-109208

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...

CVE-2026-111602

The LatePoint | Calendar & Scheduling WordPress plugin is vulnerable to Sensitive Information Exposure in versions up to and including 5.7.4 . The root cause is an ORM Operator Injection occurring via the params (customer[uuid]) parameter. This allows unauthenticated attackers to extract sensitiv...

CVE-2026-111602 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params customeruuid' parameter. This makes it possible for unauthenticated attackers to extrac...

CVE-2026-111602 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params customeruuid' parameter. This makes it possible for unauthenticated attackers to extrac...

EUVD-2026-103216

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...

CVE-2026-110653 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

CVE-2026-110653 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in th...

CVE-2026-110653

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress for WordPress is vulnerable to an unauthenticated authentication bypass in all versions up to and including 5.7.4 . The root cause is a race condition (TOCTOU) within the verifyOTP function due to a non-atomic read-m...

CLSA-2026-1792201276 TuxCare security update for @babel/plugin-transform-exponentiation-operator (1 CVE)

TuxCare rebuilt @babel/plugin-transform-exponentiation-operator to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792201275 TuxCare security update for @babel/plugin-transform-exponentiation-operator (2 CVEs)

TuxCare rebuilt @babel/plugin-transform-exponentiation-operator to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

CLSA-2026-1792201277 TuxCare security update for @babel/plugin-transform-exponentiation-operator (2 CVEs)

TuxCare rebuilt @babel/plugin-transform-exponentiation-operator to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792201269 TuxCare security update for @babel/plugin-transform-exponentiation-operator (1 CVE)

TuxCare rebuilt @babel/plugin-transform-exponentiation-operator to address 1 CVE. Fixed in 7.16.7-tuxcare.3...

CLSA-2026-1792201268 TuxCare security update for @babel/plugin-transform-exponentiation-operator (1 CVE)

TuxCare rebuilt @babel/plugin-transform-exponentiation-operator to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CLSA-2026-1792201267 TuxCare security update for @babel/plugin-transform-exponentiation-operator (1 CVE)

TuxCare rebuilt @babel/plugin-transform-exponentiation-operator to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792201265 TuxCare security update for @babel/plugin-transform-exponentiation-operator (1 CVE)

TuxCare rebuilt @babel/plugin-transform-exponentiation-operator to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

CLSA-2026-1792201266 TuxCare security update for @babel/plugin-transform-exponentiation-operator (1 CVE)

TuxCare rebuilt @babel/plugin-transform-exponentiation-operator to address 1 CVE. Fixed in 7.29.0-tuxcare.2...