CVE-2026-89031: Authorization Bypass Through User-Controlled Key

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2scalendarmovepost AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2sposts table using only the attacker-supplied b2sid primary key with...

CVE-2026-73945

creationtimestamp| type| source ---|---|--- 2026-09-15 22:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlmqa2bfw2j 2026-09-15 22:09:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvlnathuqv25 2026-09-22 03:37:07+00:00| seen|...

CVE-2026-76443

creationtimestamp| type| source ---|---|--- 2026-09-14 17:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mviocanazr2f 2026-09-14 18:09:03+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvipe5mx322g 2026-09-14 18:32:41+00:00| seen|...

CVE-2026-88802: Missing Authorization

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...

CVE-2026-54047

creationtimestamp| type| source ---|---|--- 2026-09-11 17:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvb3rquccx2f 2026-09-11 18:08:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hh4d5o26wjn56 2026-09-11 18:08:41+00:00| seen|...

WordPress Weaver Show Posts plugin < 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Do Xuan Trung in WordPress Plugin Weaver Show Posts versions 1.8.1...

CVE-2026-86782: Authorization Bypass Through User-Controlled Key

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts...

CVE-2026-89086

creationtimestamp| type| source ---|---|--- 2026-09-10 21:00:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv6x2w74gh24 2026-09-10 22:08:09+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv72tzbqc522 2026-09-10 22:20:04+00:00| seen|...

CVE-2026-68488

creationtimestamp| type| source ---|---|--- 2026-09-10 17:40:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6luqxvi325 2026-09-10 18:09:22+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6nj22xqz2g 2026-09-13 05:30:26+00:00| seen|...

CVE-2026-81046

creationtimestamp| type| source ---|---|--- 2026-09-10 17:28:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fgcb3jfvphwvh 2026-09-10 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6lcr6a442f 2026-09-10 18:08:02+00:00| seen|...

CVE-2026-88899

creationtimestamp| type| source ---|---|--- 2026-09-10 17:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6k6ywae72y 2026-09-10 18:08:45+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6nhwumim2j 2026-09-18 04:00:15+00:00| seen|...

WordPress Posts map plugin <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by MAJidox in WordPress Plugin Posts map versions = 0.1.3...

CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

CVE-2026-84222

The Kirki WordPress plugin (versions 6.2.1-6.2.5 ) is vulnerable to unauthenticated non-public post content disclosure. The root cause is a failure to verify if a requester has permission to read a post before rendering and returning its page content. This allows unauthenticated users to retrieve...

EUVD-2026-71933

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-lev...

WordPress Smart Post plugin 4.0.0-4.0.7 - Contributor+ Private and Protected Post Content Disclosure vulnerability

Contributor+ Private and Protected Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions 4.0.0-4.0.7...

PT-2026-86361

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2026-17517

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...

CVE-2026-17517 Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...