CVE-2026-18037

The Create WordPress plugin (by Mediavine) versions prior to 2.5.4 is vulnerable to an authorization bypass. The root cause is a missing authorization check on a public REST API route , which allows unauthenticated attackers to read unpublished content . Furthermore, accessing this route triggers...

CVE-2026-10524 CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation

The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...

PT-2026-68634

Name of the Vulnerable Software and Affected Versions CoCart WordPress plugin versions prior to 4.9.0 Description An issue exists where the software fails to validate user-supplied price values against the actual product price when items are added to the cart via public REST API endpoints. This...

PT-2026-68651

Name of the Vulnerable Software and Affected Versions WP Hotel Booking versions prior to 2.3.3 Description Unauthenticated users can manipulate the total price of a booking by submitting non-positive values for the qty parameter to the public REST API endpoint. This occurs because the software...

CVE-2026-6675

The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to Unauthenticated Open Email Relay in all versions up to, and including, 2.2.0. This is due to insufficient authorization checks and missing server-side validation of the recipient email address supplie...

CVE-2025-14043 Tainacan <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section Creation

The Tainacan plugin for WordPress is vulnerable to unauthorized metadata section creation due to missing authorization checks in all versions up to, and including, 1.0.1. This is due to the createitempermissionscheck function unconditionally returning true, which bypasses authentication and...

PT-2019-19328

Name of the Vulnerable Software and Affected Versions Couchbase Sync Gateway version 2.1.2 Description The issue allows an attacker with access to the Sync Gateway's public REST API to extract sensitive data or call arbitrary N1QL functions through the parameters startkey and endkey on the " all...