41338 matches found
CVE-2026-6206
The MW WP Form plugin for WordPress (versions
CVE-2026-6206 MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter
The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the getpostpropertyfromquerystring function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract da...
CVE-2026-6073
creationtimestamp| type| source ---|---|--- 2026-05-14 07:52:53+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-14 2026-05-14 09:07:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlshrdvr4t2r 2026-05-14 18:00:00+00:00| seen|...
CVE-2026-1630
creationtimestamp| type| source ---|---|--- 2026-05-14 06:55:00+00:00| seen| https://cert.pl/en/posts/2026/05/CVE-2026-1630...
EUVD-2026-30255
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capability checks in the iwarsaverecipe AJAX handler. This makes it possible for unauthenticated...
CVE-2026-7481
creationtimestamp| type| source ---|---|--- 2026-05-14 06:40:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mls7jb7h3w2l 2026-05-14 07:52:53+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-14 2026-05-14 18:00:00+00:00| seen|...
CVE-2026-6271
creationtimestamp| type| source ---|---|--- 2026-05-14 06:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mls72nq6sn2q 2026-05-14 09:06:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlshon6mjj2k 2026-05-14 13:30:30+00:00| seen|...
CVE-2026-7525
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...
CVE-2026-29206
creationtimestamp| type| source ---|---|--- 2026-05-14 03:54:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlrwb25mje2s 2026-05-20 06:20:46+00:00| seen| https://www.acn.gov.it/portale/w/cpanel-whm-e-wp-squared-poc-pubblico-per-lo-sfruttamento-della-cve-2026-29205...
CVE-2026-46419
creationtimestamp| type| source ---|---|--- 2026-05-14 03:54:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlrwasixhi2k...
CVE-2026-7525 My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...
CVE-2026-7525
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...
EUVD-2026-30217
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...
CVE-2026-7525
The CVE pertains to WordPress plugin My Calendar – Accessible Event Manager (versions ≤ 3.7.9). It describes an authorization bypass: authenticated users with custom-level access can tamper with the POST body (e.g., event_approved) to publish events or set statuses (cancelled, private) beyond the...
CVE-2026-7525 My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...
CVE-2026-6929
creationtimestamp| type| source ---|---|--- 2026-05-14 02:50:33+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mlrsoimqbh24...
CVE-2026-32991
creationtimestamp| type| source ---|---|--- 2026-05-14 02:46:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrsgkjgte2e 2026-05-20 06:20:46+00:00| seen| https://www.acn.gov.it/portale/w/cpanel-whm-e-wp-squared-poc-pubblico-per-lo-sfruttamento-della-cve-2026-29205...
CVE-2026-8500
creationtimestamp| type| source ---|---|--- 2026-05-14 02:36:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrrunabrp2h...