CVE-2026-6206 MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter

The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the getpostpropertyfromquerystring function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract da...

CVE-2026-5395

creationtimestamp| type| source ---|---|--- 2026-05-14 08:02:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlsdz4dcz62t 2026-05-14 09:28:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlsivoihzf2i 2026-05-14 09:36:20+00:00| seen|...

WS-2019-0173

keystone before 4.0.0 fails to properly encode rendered HTML on admin-created blog posts. this leads to Cross-Site Scripting...

CVE-2026-8328

creationtimestamp| type| source ---|---|--- 2026-05-14 00:03:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrjejlkhq2i 2026-05-14 01:19:43+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlrnl5s34g22 2026-05-17 15:04:58+00:00| seen|...

PT-2026-40896

Name of the Vulnerable Software and Affected Versions MW WP Form versions prior to 5.1.3 Description Insufficient restrictions in the get post property from querystring function allow unauthenticated attackers to extract data from private, draft, or password-protected posts. Recommendations Updat...

uBidAuction cross-site scripting vulnerability (CNVD-2026-31517)

uBidAuction is an auction website system developed by the uBidAuction company, which supports online auctions and product transaction management. uBidAuction has a cross-site scripting vulnerability. This vulnerability arises due to the incorrect handling of the datecreated, datefrom, dateto, and...

WordPress plugin MW WP Form 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-7051

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. This is due to a missing ownership verification in the B2SPostTools::deleteUserPublishPost and B2SPostTools::deleteUserSchedPost functions,...

CVE-2025-61972

creationtimestamp| type| source ---|---|--- 2026-05-13 05:11:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlpk3nswl32n 2026-05-13 05:35:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlplh5jpni2v...

CVE-2025-62624

creationtimestamp| type| source ---|---|--- 2026-05-13 05:05:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlpjquxwyp2e 2026-05-13 05:15:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlpkddgxeu2k...

CVE-2025-62623

creationtimestamp| type| source ---|---|--- 2026-05-13 04:55:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlpj6xekod2k 2026-05-13 05:00:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlpjhw52sy2n...

CVE-2026-7051

The CVE-2026-7051 entry concerns the Blog2Social WordPress plugin (versions up to 8.9.0) with a Missing Authorization issue. The root cause is missing blog_user_id constraints in B2S_Post_Tools::deleteUserPublishPost() and deleteUserSchedPost(), allowing an authenticated subscriber+ to delete oth...

CVE-2026-7051 Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. This is due to a missing ownership verification in the B2SPostTools::deleteUserPublishPost and B2SPostTools::deleteUserSchedPost functions,...

EUVD-2026-29899

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. This is due to a missing ownership verification in the B2SPostTools::deleteUserPublishPost and B2SPostTools::deleteUserSchedPost functions,...

CVE-2026-41901

creationtimestamp| type| source ---|---|--- 2026-05-13 01:34:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlp5xdbnw42p 2026-05-13 03:10:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlpddjlakx2w 2026-09-12 10:00:05+00:00| seen|...

CVE-2026-42288

creationtimestamp| type| source ---|---|--- 2026-05-13 01:30:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlp5qjkhja2g 2026-05-13 01:30:36+00:00| seen| https://infosec.exchange/users/offseq/statuses/116564677807182613 2026-05-13 01:31:22+00:00| seen|...

CVE-2026-44548

creationtimestamp| type| source ---|---|--- 2026-05-13 01:21:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlp5am37m42p 2026-05-13 01:23:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlp5eh2e672e 2026-05-13 03:10:31+00:00| seen|...

CVE-2026-44547

creationtimestamp| type| source ---|---|--- 2026-05-13 00:00:38+00:00| seen| https://infosec.exchange/users/offseq/statuses/116564324244482665 2026-05-13 00:00:39+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mloypqjnid2d 2026-05-13 02:00:45+00:00| seen|...

WordPress plugin Custom Twitter Feeds 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

PT-2026-40563

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. This is due to a missing ownership verification in the B2S Post Tools::deleteUserPublishPost and B2S Post Tools::deleteUserSchedPost...