CVE-2026-88899

creationtimestamp| type| source ---|---|--- 2026-09-10 17:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6k6ywae72y 2026-09-10 18:08:45+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6nhwumim2j 2026-09-18 04:00:15+00:00| seen|...

WordPress Posts map plugin <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by MAJidox in WordPress Plugin Posts map versions = 0.1.3...

CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

CVE-2026-84222

The Kirki WordPress plugin (versions 6.2.1-6.2.5 ) is vulnerable to unauthenticated non-public post content disclosure. The root cause is a failure to verify if a requester has permission to read a post before rendering and returning its page content. This allows unauthenticated users to retrieve...

CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

EUVD-2026-71933

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-lev...

WordPress Smart Post plugin 4.0.0-4.0.7 - Contributor+ Private and Protected Post Content Disclosure vulnerability

Contributor+ Private and Protected Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions 4.0.0-4.0.7...

PT-2026-86361

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2026-17517

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...

CVE-2026-17517 Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...

CVE-2026-17517

The Content Views WordPress plugin (versions before 4.5.1.2 ) is vulnerable to an unauthenticated non-public post content disclosure. The root cause is a failure to verify if a requesting user is authorized to read the posts returned by a specific view. This allows unauthenticated attackers to ob...

CVE-2026-17517 Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...

EUVD-2026-70901

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...

CVE-2026-80438: Improper Access Control

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

PT-2026-85407

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...

CVE-2026-17517: Exposure of Sensitive Information to an Unauthorized Actor

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...

CVE-2023-3360

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

CVE-2023-3360 Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

CVE-2023-3360

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, enabling PHP object injection when a high-privilege user imports a malicious file and a suitable gadget chain exists on the blog. The vulnerability is rated CVSS 3.3 (LOW) with high attack complexity...

CVE-2023-3360 Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...