CVE-2026-16274 Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...

CVE-2026-64814

creationtimestamp| type| source ---|---|--- 2026-08-03 05:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3ms5rquz3q42y...

CVE-2024-38798

creationtimestamp| type| source ---|---|--- 2026-08-03 04:09:39+00:00| seen| https://bsky.app/profile/nvnb.misskey.io.ap.brid.gy/post/3ms5muf6wbrl2...

PT-2026-67633

Name of the Vulnerable Software and Affected Versions Zyxel WAX650S versions prior to 7.10ABRM.4C0 Description A post-authentication command injection issue exists in the "export-cgi" CGI program. This allows an authenticated attacker with administrator privileges to execute arbitrary operating...

CVE-2026-56673

creationtimestamp| type| source ---|---|--- 2026-08-02 19:00:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4o6frjq32t...

CVE-2026-56672

creationtimestamp| type| source ---|---|--- 2026-08-02 19:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4o675pfx2b...

CVE-2026-67356

creationtimestamp| type| source ---|---|--- 2026-08-02 16:12:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4es7oylx2x...

CVE-2026-68578

creationtimestamp| type| source ---|---|--- 2026-08-02 14:01:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms45i7bwtm2t 2026-08-03 02:39:01+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117029256627432016...

CVE-2026-15048

creationtimestamp| type| source ---|---|--- 2026-08-02 13:03:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms423xtogy2t...

CVE-2025-71402

creationtimestamp| type| source ---|---|--- 2026-08-02 11:39:50+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3ms3vkldfn52c...

CVE-2026-15248

creationtimestamp| type| source ---|---|--- 2026-08-02 11:09:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3tqjl2lz2x...

CVE-2026-15939

creationtimestamp| type| source ---|---|--- 2026-08-02 10:54:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3sytcj3t2z 2026-08-02 11:50:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3w6266kl2v 2026-08-02 11:51:03+00:00| seen|...

CVE-2026-16064

creationtimestamp| type| source ---|---|--- 2026-08-02 10:51:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3stj67we25 2026-08-02 11:55:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3wh2p2wf2z 2026-08-02 11:56:11+00:00| seen|...

CVE-2026-16273

The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the...

CVE-2026-14864

The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as...

CVE-2026-13389 WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before...

CVE-2026-16064 Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...

CVE-2026-16063

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary...

EUVD-2026-51949

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary...

CVE-2026-16064

CVE-2026-16064 affects the Event Booking Manager for WooCommerce WordPress plugin (pre-5.3.7). The root cause is improper authorization on objects being modified during quick-edit actions, validating only a global capability. This permits users with Contributor role and above to alter the title a...