EUVD-2026-32095

The Post Category Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'postcategorygallery' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as...

CVE-2026-8867

CVE-2026-8867 affects the WordPress plugin Post Categories Gallery (versions

CVE-2026-8701

The CVE-2026-8701 entry describes a Stored XSS in the WordPress plugin GNTT Post Title Ticker (versions

CVE-2026-8939

The CVE-2026-8939 entry concerns the WordPress plugin Search Simple Fields (

CVE-2025-14481

The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated...

CVE-2025-14481 Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter

The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated...

CVE-2025-14481 Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter

The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated...

CVE-2025-14481

The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated...

CVE-2025-14481

The CVE concerns the WordPress Yoast SEO plugin (versions up to and including 26.5). The root cause is insufficient authorization checks in the Meta Search REST API endpoint, which fails to verify post ownership. This allows authenticated attackers with Contributor-level access or higher to read ...

EUVD-2025-209950

The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated...

CVE-2026-9631

creationtimestamp| type| source ---|---|--- 2026-05-27 04:00:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmsmniu4hc2n 2026-05-27 05:08:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmsqhssf332h...

CVE-2026-35089

creationtimestamp| type| source ---|---|--- 2026-05-27 03:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-35087 2026-05-27 15:38:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmttnp42zq2c...

CVE-2026-35087

creationtimestamp| type| source ---|---|--- 2026-05-27 03:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-35087 2026-05-27 16:04:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmtv4w342p2i...

CVE-2026-9627

creationtimestamp| type| source ---|---|--- 2026-05-27 03:01:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmsjdzvoso2w 2026-05-27 05:28:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmsrkwg7wh2q...

CVE-2026-9022 Splide Carousel Block <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' Block Attribute

The Splide Carousel Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'url' Block Attribute in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-8606

creationtimestamp| type| source ---|---|--- 2026-05-27 01:48:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmsfb74agt2i...

CVE-2026-9584

creationtimestamp| type| source ---|---|--- 2026-05-27 01:33:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmsegdt5cw2q...

CVE-2026-9603

creationtimestamp| type| source ---|---|--- 2026-05-27 01:21:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmsdry7r5r2h...

Exploit for Deserialization of Untrusted Data in Drupal

CVE-2019-6340 — Drupal RESTful Web Services RCE Python imple...

WordPress plugin Duplicate Page and Post SQL注入漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...