49613 matches found
CVE-2026-88974 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...
CVE-2026-96455
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...
CVE-2026-87071
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...
CVE-2026-87848 MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...
WordPress MPCX Lightbox plugin 1.2.2-1.2.5 - Unauthenticated Non-Public Post Content Disclosure vulnerability
Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Brian Willows in WordPress Plugin MPCX Lightbox versions 1.2.2-1.2.5...
CVE-2026-87071 Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...
CVE-2026-87071 Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...
CVE-2026-87071
The Forminator Forms WordPress plugin versions before 1.57.2.1 is vulnerable to Unauthenticated Post Meta Injection . The root cause is the plugin's failure to restrict metadata keys provided during form submissions or to exclude keys reserved by WordPress. Consequently, unauthenticated visitors ...
WordPress Forminator Forms plugin < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts vulnerability
Unauthenticated Post Meta Injection on Submitted Posts vulnerability discovered by Dion Mulaj in WordPress Plugin Forminator versions 1.57.2.1...
CVE-2026-96455 Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...
CVE-2026-96455 Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...
CVE-2026-96455
The Reachy Mini daemon is vulnerable to unauthenticated remote code execution due to a missing authentication check on its app installation endpoint (POST /apps/install ). An attacker on the same local network can exploit this by providing a body that names a public Hugging Face Space. The daemon...
CVE-2026-96455 Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...
EUVD-2026-85185
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...
WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Google Threat Intelligence Group in WordPress Plugin The Post Grid versions = 7.9.5...
CVE-2026-93508
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...
CVE-2026-93507
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...
CVE-2026-86783
The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including...
CVE-2026-88997
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...
EUVD-2026-85061
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...