CVE-2026-65896: External Control of File Name or Path

Grav API Plugin Composer package getgrav/grav-plugin-api before 1.0.10 fails to properly validate the slug field in the POST /pages/route/move endpoint. PagesController::move sanitizes the slug only with ltrim$body'slug', '.', which strips leading periods but does not neutralize '/' or '..'...

CVE-2026-1314 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sendpostpagesjson function in all versions up to, and including, 1.16.17. This makes it possible for unauthenticat...

CVE-2024-0830: Cross-Site Request Forgery (CSRF)

The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0. This is due to missing or incorrect nonce validation on several ajax actions. This makes it possible for unauthenticated attackers to invoke...

CVE-2024-0829: Missing Authorization

The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0. This is due to missing or incorrect capability checks on several ajax actions. This makes it possible for authenticated attackers, with subscribe...

WordPress Insert Pages License Issue Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An authorization issue vulnerability exists in the WordPress Insert Pages plugin in versions prior to 3.7.0,...

Reviews Plus < 1.2.14 - Subscriber+ Reviews DoS

The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page Enable reviews for post/pages, and enable the "Show...

CVE-2020-28705: Cross-Site Request Forgery (CSRF)

FUEL CMS 1.4.13 contains a cross-site request forgery CSRF vulnerability that can delete a page via a post ID to /pages/delete/3...

Weiphp information leakage vulnerability

Weiphp is a WeChat development platform that supports the development of public numbers and small programs by China's Shenzhen Yuanmeng Yun Weiphp company. An information disclosure vulnerability exists in WeiPHP 5.0, which stems from a failure to properly restrict access to pages associated with...

Weiphp 信息泄露漏洞

Weiphp is a WeChat development platform that supports the development of public numbers and small programs by China's Shenzhen Yuanmeng Yun Weiphp company. An information disclosure vulnerability exists in WeiPHP 5.0, which stems from a failure to properly restrict access to pages associated with...

WP-EMail <= 2.67.2 - Cross-Site Scripting (XSS)

If the Plugin is activated then the email submission form can be found on the /email/ directory on individual Post/Pages. For example: http://example.com/2017/05/31/hello-world/email/...