WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scripting

WordPress Post Status Notifier Lite plugin before 1.10.1 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

WordPress Secure Custom Fields plugin < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure vulnerability

Contributor+ Unpublished Post Title and Status Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Secure Custom Fields versions 6.9.8...

WordPress Advanced Custom Fields (ACF®) plugin < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure vulnerability

Contributor+ Unpublished Post Title and Status Disclosure vulnerability discovered by vuxvinh in WordPress Plugin Advanced Custom Fields versions 6.8.11...

EUVD-2026-116736

The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review...

CVE-2026-119702

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak...

CVE-2026-119702 WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak...

CVE-2026-119702 WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak...

CVE-2026-119702

WPGraphQL versions before 2.24.1 are vulnerable to a missing authorization vulnerability within the createComment mutation . This flaw allows unauthenticated attackers to bypass post status checks and attach comments to non-public posts, such as draft , private , trashed , or password-protected c...

CVE-2026-119702 WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak...

EUVD-2026-114107

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak...

CVE-2026-112347

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/pageid route and the savepagedata, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware...

CVE-2026-119702: WPGraphQL: WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows…

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak...

PT-2026-133558

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/page id route and the save page data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middlewar...

CVE-2026-112347: Themeum Kirki: Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST…

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/pageid route and the savepagedata, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware...

PT-2026-133636

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak...

CVE-2026-114120

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpspeleditorform AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or...

CVE-2026-114120 SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpspeleditorform AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or...

CVE-2026-114120

Versions of SchedulePress before 5.3.5 are vulnerable to a missing authorization vulnerability via the wpsp_el_editor_form AJAX action. Authenticated users with Contributor-level privileges can exploit this by reusing the wpsp-el-editor nonce from the Elementor modal to modify post statuses and p...

CVE-2026-114120 SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpspeleditorform AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or...

EUVD-2026-107232

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpspeleditorform AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or...