CVE-2026-16064 Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...

CVE-2026-16063

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary...

EUVD-2026-51949

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary...

CVE-2026-16064

CVE-2026-16064 affects the Event Booking Manager for WooCommerce WordPress plugin (pre-5.3.7). The root cause is improper authorization on objects being modified during quick-edit actions, validating only a global capability. This permits users with Contributor role and above to alter the title a...

CVE-2026-16273

The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the...

EUVD-2026-51944

The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the...

CVE-2026-16273 Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta

The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the...

CVE-2026-16273

CVE-2026-16273 affects the Narrative Publisher WordPress plugin (

CVE-2026-14864

The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as...

EUVD-2026-51929

The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as...

CVE-2026-14864

CVE-2026-14864 affects the JetEngine WordPress plugin up to version 3.8.12. The vulnerability arises because a post meta value is not escaped before being output by a JetEngine shortcode, enabling Stored XSS when exploited by users with Contributor role or higher. Impact is that an attacker could...

CVE-2026-18352

creationtimestamp| type| source ---|---|--- 2026-08-02 01:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2rtsjy6e2z 2026-08-02 08:09:11+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms3jrvygge2p 2026-08-02 08:35:49+00:00| seen|...

CVE-2026-13339

creationtimestamp| type| source ---|---|--- 2026-08-02 01:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2rtm67nw2n 2026-08-02 08:36:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3ldebc5q2e 2026-08-02 08:36:59+00:00| seen|...

CVE-2026-67291

creationtimestamp| type| source ---|---|--- 2026-08-02 00:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2oiob3iy2t...

CVE-2026-67304

creationtimestamp| type| source ---|---|--- 2026-08-02 00:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2oihufp22b 2026-08-02 17:09:04+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117027006957378264...

CVE-2026-67300

creationtimestamp| type| source ---|---|--- 2026-08-01 23:00:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2l56spgn2z...

CVE-2026-67339

creationtimestamp| type| source ---|---|--- 2026-08-01 22:02:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2huriq3b2x 2026-08-01 22:02:27+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3ms2huylfhn2c 2026-08-01 22:02:35+00:00| seen|...

CVE-2026-67308

creationtimestamp| type| source ---|---|--- 2026-08-01 21:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2egyp24c2b 2026-08-01 21:27:10+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117022368056209142 2026-08-02 12:28:05+00:00| seen|...

CVE-2026-67289

creationtimestamp| type| source ---|---|--- 2026-08-01 20:12:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms2bpmtxek2l 2026-08-02 07:30:24+00:00| seen| https://infosec.exchange/users/offseq/statuses/117024740061481140 2026-08-05 02:24:03+00:00| seen|...

CVE-2026-66402

creationtimestamp| type| source ---|---|--- 2026-08-01 20:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms2bm2o5mc2a 2026-08-02 09:00:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3ms3mnkwzbp2x 2026-08-02 09:02:35+00:00| seen|...