CVE-2026-119032

The Schema & Structured Data for WP & AMP WordPress plugin, in versions before 1.70 , is vulnerable to Authenticated Arbitrary Post Modification . The root cause is a failure to verify if an importing user has permission to edit posts specified in a settings backup , coupled with a lack of restri...

WordPress Schema & Structured Data for WP & AMP plugin < 1.70 - Authenticated Arbitrary Post Modification vulnerability

Authenticated Arbitrary Post Modification vulnerability discovered by Raphael P. Cigana in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.70...

EUVD-2026-123177

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data...

CVE-2026-119032 Schema & Structured Data for WP & AMP < 1.70 - Authenticated Arbitrary Post Modification via Backup Import

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data...

PT-2026-145013

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data...

CVE-2026-85344 FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing Authorization

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to ed...

CVE-2026-85344

The FV Flowplayer Video Player WordPress plugin versions prior to 7.5.57.7212 is vulnerable to a missing authorization flaw. An authenticated user, even at the subscriber-level , can trigger an AJAX action that performs a site-wide content rewrite. This allows the attacker to perform a bulk modif...

WordPress FV Flowplayer Video Player plugin < 7.5.57.7212 - Subscriber+ Bulk Post Modification vulnerability

Subscriber+ Bulk Post Modification vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin FV Flowplayer Video Player versions 7.5.57.7212...

WordPress Fiber Admin plugin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification vulnerability

Unauthenticated Arbitrary Post and Term Order Modification vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Fiber Admin versions 4.0.1...

WordPress Mapster WP Maps plugin < 2.0.6 - Unauthenticated Arbitrary Post Modification vulnerability

Unauthenticated Arbitrary Post Modification vulnerability discovered by Usama Arshad in WordPress Plugin Mapster WP Maps versions 2.0.6...

CVE-2026-118638

The Mapster WP Maps WordPress plugin versions before 2.0.6 is vulnerable to an unauthenticated arbitrary post modification vulnerability. The root cause is a missing authorization check on a REST API route used to write post data (specifically identified in some records as the save-mapmaker route...

CVE-2026-118638 Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...

CVE-2026-118638 Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...

WordPress Modern Events Calendar Lite plugin < 7.36.4 - Subscriber+ Arbitrary Post Modification vulnerability

Subscriber+ Arbitrary Post Modification vulnerability discovered by Nguyen Duc Thinh in WordPress Plugin Modern Events Calendar Lite versions 7.36.4...

CVE-2026-118101 BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages,...

CVE-2026-118101

The BuddyForms WordPress plugin, in versions prior to 2.10.1 , is vulnerable to an arbitrary post modification issue due to a missing authorization check. The plugin fails to verify if a user editing an existing entry is the actual author of the target post. This allows users with form edit acces...

CVE-2026-118101 BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages,...

WordPress BuddyForms plugin < 2.10.1 - Subscriber+ Arbitrary Post Modification vulnerability

Subscriber+ Arbitrary Post Modification vulnerability discovered by Furkan Arslan in WordPress Plugin BuddyForms versions 2.10.1...

CVE-2026-115259

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access...

WordPress AI Engine plugin < 3.7.9 - Editor+ Arbitrary Post Modification vulnerability

Editor+ Arbitrary Post Modification vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin AI Engine versions 3.7.9...