EUVD-2026-53103

The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public draft, private, and pending posts on sites that have a captcha provider...

CVE-2026-16602

The Passster (Content Protector) WordPress plugin in versions before 4.3.6 is vulnerable to an unauthenticated information disclosure. The root cause is a failure to perform a post-status check before returning post content from an unauthenticated REST endpoint. If a site has a captcha provider c...

CVE-2026-16603 Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API...

CVE-2026-16602 Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint

The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public draft, private, and pending posts on sites that have a captcha provider...

CVE-2026-16603 Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API...

EUVD-2026-53058

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

CVE-2026-15941

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

CVE-2026-18859

creationtimestamp| type| source ---|---|--- 2026-08-05 02:24:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3colvpruqxjrw 2026-08-05 02:26:09+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mschzbyjyi2l...

CVE-2026-18881: Improper Neutralization of Special Elements used in an SQL Command

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the filterdatacommentcount parameter of the public tableongettabledata AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied...

CVE-2026-16603: Exposure of Sensitive Information to an Unauthorized Actor

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API...

CVE-2026-70619

creationtimestamp| type| source ---|---|--- 2026-08-04 22:09:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dqncya2mxc36p 2026-08-04 23:00:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msc4jhvpk42n...

CVE-2026-69110

creationtimestamp| type| source ---|---|--- 2026-08-04 16:46:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hx2djdxo2nr7y 2026-08-04 17:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msbige4sax2t 2026-08-04 18:12:05+00:00| seen|...

CVE-2026-67247

creationtimestamp| type| source ---|---|--- 2026-08-04 14:27:48+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msb7ureywf25 2026-08-04 14:59:23+00:00| seen| https://bsky.app/profile/potato.software/post/3msbbnaqvro2i...

WordPress WOLF plugin < 1.1.0 - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS vulnerability

WordPress WOLF plugin 1.1.0 - WordPress Posts Bulk Editor and Manager 1.1.0 - Stored XSS vulnerability discovered by she11f in WordPress Plugin WOLF versions 1.1.0...

CVE-2026-15721

creationtimestamp| type| source ---|---|--- 2026-08-04 10:12:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/cjbyppr37r6vy 2026-08-04 13:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msb2z7pf2r2e 2026-08-04 13:34:04+00:00| seen|...

CVE-2026-18685

creationtimestamp| type| source ---|---|--- 2026-08-03 23:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7p5zk45z2f 2026-08-04 00:00:37+00:00| seen| https://infosec.exchange/users/offseq/statuses/117034296046822265 2026-08-04 00:00:39+00:00| seen|...

CVE-2026-67598

creationtimestamp| type| source ---|---|--- 2026-08-03 20:55:02+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms7f2blmgt2q 2026-08-03 21:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7fgvrgmd2i 2026-08-07 10:04:24+00:00|...

CVE-2026-69153

creationtimestamp| type| source ---|---|--- 2026-08-03 18:28:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gp5oyt6frvyqh 2026-08-03 18:31:17+00:00| seen| https://gist.github.com/alon710/cea21195fa5b2fd7a130b5ccd15ff053 2026-08-03 18:35:03+00:00| published-proof-of-concept|...

CVE-2026-69091

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...

CVE-2026-69091 Admidio before 5.0.11 Authentication Bypass via forum.php

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...