CVE-2026-82126 Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema Generation

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password...

EUVD-2026-80187

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...

CVE-2026-82124

The Schema & Structured Data for WP & AMP WordPress plugin (versions before 1.66 ) contains a vulnerability where it fails to verify if a post is password-protected before including its content in generated structured data. This flaw allows unauthenticated users to obtain the content of password-...

CVE-2026-85131: Cross-Site Request Forgery (CSRF)

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts...

PT-2026-93288

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...

CVE-2026-82124: Exposure of Sensitive Information to an Unauthorized Actor

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...

CVE-2026-89031: Authorization Bypass Through User-Controlled Key

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2scalendarmovepost AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2sposts table using only the attacker-supplied b2sid primary key with...

CVE-2026-73945

creationtimestamp| type| source ---|---|--- 2026-09-15 22:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlmqa2bfw2j 2026-09-15 22:09:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvlnathuqv25 2026-09-22 03:37:07+00:00| seen|...

CVE-2026-76443

creationtimestamp| type| source ---|---|--- 2026-09-14 17:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mviocanazr2f 2026-09-14 18:09:03+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvipe5mx322g 2026-09-14 18:32:41+00:00| seen|...

CVE-2026-88802: Missing Authorization

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...

CVE-2026-54047

creationtimestamp| type| source ---|---|--- 2026-09-11 17:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvb3rquccx2f 2026-09-11 18:08:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hh4d5o26wjn56 2026-09-11 18:08:41+00:00| seen|...

WordPress Weaver Show Posts plugin < 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Do Xuan Trung in WordPress Plugin Weaver Show Posts versions 1.8.1...

CVE-2026-86782: Authorization Bypass Through User-Controlled Key

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts...

CVE-2026-89086

creationtimestamp| type| source ---|---|--- 2026-09-10 21:00:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv6x2w74gh24 2026-09-10 22:08:09+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv72tzbqc522 2026-09-10 22:20:04+00:00| seen|...

CVE-2026-68488

creationtimestamp| type| source ---|---|--- 2026-09-10 17:40:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6luqxvi325 2026-09-10 18:09:22+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6nj22xqz2g 2026-09-13 05:30:26+00:00| seen|...

CVE-2026-81046

creationtimestamp| type| source ---|---|--- 2026-09-10 17:28:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fgcb3jfvphwvh 2026-09-10 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6lcr6a442f 2026-09-10 18:08:02+00:00| seen|...

CVE-2026-88899

creationtimestamp| type| source ---|---|--- 2026-09-10 17:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6k6ywae72y 2026-09-10 18:08:45+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6nhwumim2j 2026-09-18 04:00:15+00:00| seen|...

WordPress Posts map plugin <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by MAJidox in WordPress Plugin Posts map versions = 0.1.3...

CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...