CVE-2026-15939

The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing...

EUVD-2026-51952

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before...

CVE-2026-13389

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before...

CVE-2026-16064 Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...

CVE-2026-16064

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...

EUVD-2026-51950

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...

CVE-2026-15939 Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API

The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing...

CVE-2026-14841 King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget

The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a...

CVE-2026-14841 King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget

The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a...

CVE-2026-8457

creationtimestamp| type| source ---|---|--- 2026-08-02 00:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms2ooi32xk2b 2026-08-02 01:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2rtff4e32p 2026-08-02 01:30:27+00:00| seen|...

PT-2026-67094

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...

CVE-2026-16064: Incorrect Authorization

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...

PT-2026-67084

The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing...

CVE-2026-67338

creationtimestamp| type| source ---|---|--- 2026-08-01 23:16:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2lzuwy6x24 2026-08-01 23:17:05+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms2m2h37u72m 2026-08-01 23:17:06+00:00| seen|...

CVE-2026-67329

creationtimestamp| type| source ---|---|--- 2026-08-01 23:14:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2lwauabc2m 2026-08-01 23:15:04+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms2lwtkxdv2n 2026-08-01 23:15:13+00:00| seen|...

CVE-2026-67333

creationtimestamp| type| source ---|---|--- 2026-08-01 22:38:59+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms2jwd337n2v 2026-08-01 22:39:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2jwe2prf2e 2026-08-01 22:39:20+00:00| seen|...

CVE-2026-67335

creationtimestamp| type| source ---|---|--- 2026-08-01 22:14:51+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3ms2il4vsla2f 2026-08-01 23:34:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2mzkoobg2d 2026-08-01 23:34:32+00:00| seen|...

CVE-2026-67353

creationtimestamp| type| source ---|---|--- 2026-08-01 22:10:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2ie54hb32l 2026-08-01 22:11:11+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms2iemhf6r2j 2026-08-01 23:27:31+00:00| seen|...

CVE-2026-67334

creationtimestamp| type| source ---|---|--- 2026-08-01 22:05:38+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3ms2i2oy2u22r 2026-08-01 22:05:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2i2p5vtn2e 2026-08-01 23:20:04+00:00| seen|...

CVE-2026-67339

creationtimestamp| type| source ---|---|--- 2026-08-01 22:02:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2huriq3b2x 2026-08-01 22:02:27+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3ms2huylfhn2c 2026-08-01 22:02:35+00:00| seen|...