41010 matches found
CVE-2026-19075
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
CVE-2026-17018
The CVE-2026-17018 affects the CubeWP Framework WordPress plugin up to version 1.1.30. The REST API endpoint does not perform per-object read authorization and does not restrict which metadata keys may be requested, enabling users with the Contributor role or higher to read arbitrary post metadat...
EUVD-2026-55026
The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who...
CVE-2026-17018
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...
CVE-2026-17010
The CVE-2026-17010 entry covers a stored XSS vulnerability in the Saitama Addon Pack WordPress plugin (versions up to 1.0.8). The issue arises because post metadata values are not properly sanitised or escaped before output, enabling users with contributor-level access and above to inject payload...
CVE-2026-17018 CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...
EUVD-2026-55025
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...
CVE-2026-17010 Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta
The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who...
CVE-2026-16257
The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowi...
CVE-2026-16257 Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling
The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowi...
EUVD-2026-55037
The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowi...
CVE-2026-53984
creationtimestamp| type| source ---|---|--- 2026-08-10 03:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msp4ax5slh23...
CVE-2026-19380
creationtimestamp| type| source ---|---|--- 2026-08-10 02:57:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j3s7fc7zkx4aa...
CVE-2026-65509
creationtimestamp| type| source ---|---|--- 2026-08-10 02:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msozryinbq2u 2026-08-10 22:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msr4trbamb2w...
CVE-2026-5855
creationtimestamp| type| source ---|---|--- 2026-08-10 02:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msoywital725...
CVE-2026-63637
creationtimestamp| type| source ---|---|--- 2026-08-10 01:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msovkxeczc27...
CVE-2026-19369
creationtimestamp| type| source ---|---|--- 2026-08-09 22:42:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dzrqtrm37fwwb...
CVE-2026-67622
creationtimestamp| type| source ---|---|--- 2026-08-09 16:00:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msnxegt2qg2h 2026-08-10 17:18:10+00:00| seen| https://gist.github.com/haidang-infosec/402db84bee7aca2f57bb109b31574649...