CVE-2026-19077

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

EUVD-2026-55000

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-18934

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

CVE-2026-18934

The RSS Aggregator by Feedzy WordPress plugin (versions before 5.2.6 ) is vulnerable to an incorrect authorization issue. The plugin fails to verify if a requesting user owns or is permitted to modify a specific import job. Consequently, users with author-level access and above can permanently de...

CVE-2026-18934 RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

EUVD-2026-55013

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

CVE-2026-17018

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

EUVD-2026-55025

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-16257

The Arvow AI SEO Writer WordPress plugin, in versions prior to 1.5.4 , contains an improper authentication vulnerability. Unauthenticated users can bypass access controls on a specific REST endpoint by leveraging type juggling when the plugin has not been configured. This security flaw allows att...

CVE-2026-19387

creationtimestamp| type| source ---|---|--- 2026-08-10 03:22:58+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117069065622079893 2026-08-10 04:00:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msp7loglun2y 2026-08-10 04:00:01+00:00| seen|...

CVE-2026-18934: Incorrect Authorization

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

CVE-2026-19348

creationtimestamp| type| source ---|---|--- 2026-08-09 12:00:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msnjxultsu2k 2026-08-09 12:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msnjy52jnm23 2026-08-09 16:00:46+00:00| seen|...

CVE-2026-16957

The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...

CVE-2026-16957 Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure

The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...

CVE-2026-16957

The Slim SEO WordPress plugin versions prior to 4.9.11 contains a vulnerability where a post-meta preview feature fails to properly restrict access. The component verifies only read access instead of ensuring the user is authorized to edit the specific post. This allows users with the Contributor...

CVE-2026-16957 Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure

The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...

CVE-2026-16965

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

EUVD-2026-54888

The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...

PT-2026-69263

Name of the Vulnerable Software and Affected Versions Slim SEO versions prior to 4.9.11 Description A post-meta preview feature fails to restrict access to posts that the user is authorized to edit, verifying only read access. This allows users with the Contributor role to read arbitrary post met...

CVE-2026-16955

creationtimestamp| type| source ---|---|--- 2026-08-08 07:30:24+00:00| seen| https://infosec.exchange/users/offseq/statuses/117058713911525712 2026-08-08 07:30:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mskkg4ykio2a 2026-08-08 08:50:01+00:00| seen|...