CVE-2026-87848 MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure

The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...

WordPress MPCX Lightbox plugin 1.2.2-1.2.5 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Brian Willows in WordPress Plugin MPCX Lightbox versions 1.2.2-1.2.5...

WordPress Copy & Delete Posts plugin < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure vulnerability

Authenticated Arbitrary Post Content and Password Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Duplicate Post versions 1.5.6...

CVE-2026-16274

The Classified Listing WordPress plugin versions prior to 5.4.4 is vulnerable to unauthorized content disclosure via the rtcl_block_css_get_posts AJAX action. The root cause is a failure to perform capability or ownership checks , allowing users with contributor-level access and above to read any...

CVE-2026-14839 Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

WordPress Mapster WP Maps plugin < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure vulnerability

Unauthenticated Private and Draft Post Content Disclosure vulnerability discovered by Alexander Jurkschat in WordPress Plugin Mapster WP Maps versions 1.24.0...

CVE-2026-14839 Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

CVE-2026-14839

The Mapster WP Maps WordPress plugin (versions before 1.24.0 ) contains a vulnerability where it fails to perform authorization or post-status checks on a public REST endpoint. This allows unauthenticated users to retrieve the title and full content of any post, including those with statuses such...

CVE-2026-14195 Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info

The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts...

WordPress Ultimate Post Kit plugin < 4.0.16 - Unauthenticated Arbitrary Post Content Disclosure vulnerability

Unauthenticated Arbitrary Post Content Disclosure vulnerability discovered by Drtime in WordPress Plugin Ultimate Post Kit versions 4.0.16...

WordPress Plugin Under Construction / Maintenance Mode from Acurax Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

CVE-2023-3707 ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Content Disclosure

The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post such as draft and private via an IDOR vector. Password protected post...

CVE-2023-0749

The CVE-2023-0749 entry concerns the Ocean Extra WordPress plugin before version 2.1.3. The vulnerability arises because the plugin does not verify that a template loaded via a shortcode is actually a template, allowing any authenticated user (e.g., a subscriber) to retrieve content from arbitrar...

PT-2009-1236 · Apache · Apache Tomcat

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 4.1.32 through 4.1.34 Apache Tomcat versions 5.5.10 through 5.5.20 Description: The issue is related to the doRead method, which fails to return a -1 when a certain error condition occurs. This can cause Tomcat to send...