CVE-2026-92548 WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters

The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...

CVE-2026-87848 MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure

The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...

WordPress MPCX Lightbox plugin 1.2.2-1.2.5 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Brian Willows in WordPress Plugin MPCX Lightbox versions 1.2.2-1.2.5...

CVE-2026-79916

creationtimestamp| type| source ---|---|--- 2026-09-21 21:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mw2nc63aoz2j 2026-09-21 22:04:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mw2prspa6w2z 2026-09-21 22:07:40+00:00| seen|...

WordPress Schema & Structured Data for WP & AMP plugin 1.63-1.65 - Contributor+ Non-Public Post Content Disclosure vulnerability

Contributor+ Non-Public Post Content Disclosure vulnerability discovered by Shirshak in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.63-1.65...

WordPress Kirki plugin 6.2.1-6.2.5 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Kirki versions 6.2.1-6.2.5...

WordPress Content Views plugin < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Content Views versions 4.5.1.2...

EUVD-2026-54888

The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...

GHSA-94G3-G5V7-Q4JG

creationtimestamp| type| source ---|---|--- 2026-08-08 03:53:49+00:00| seen| https://bsky.app/profile/mel-echosphere.bsky.social/post/3msk6crnt3x2y...

CVE-2026-15239

creationtimestamp| type| source ---|---|--- 2026-08-07 08:52:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7c4u2inhxyt6o...

CVE-2026-13154 Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as...

CVE-2026-13154

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as...

EUVD-2026-53736

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as...

CVE-2026-13154

The Gutenberg Essential Blocks WordPress plugin (versions before 6.4.0 ) is vulnerable to unauthenticated content disclosure. The root cause is a failure to verify if an attacker-supplied post type is publicly viewable before querying it within one of its public REST routes . This allows unauthen...

CVE-2026-13154 Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as...

CVE-2026-8709

creationtimestamp| type| source ---|---|--- 2026-08-05 17:16:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdzqlgrfd2m 2026-08-06 16:15:47+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-781 2026-09-05 03:16:47+00:00| seen|...

CVE-2025-69942

creationtimestamp| type| source ---|---|--- 2026-07-30 18:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrv43l5oh42q...

CVE-2026-14545

creationtimestamp| type| source ---|---|--- 2026-07-28 08:06:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mroxdaviyq2q 2026-07-28 14:14:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrpltsrhpu22...

CVE-2026-65688

creationtimestamp| type| source ---|---|--- 2026-07-23 15:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrd4ckwn622k 2026-07-23 16:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrd7hshcma2g 2026-07-29 21:37:07+00:00| seen|...

CVE-2026-13078

creationtimestamp| type| source ---|---|--- 2026-07-22 21:00:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrb7qtya562a 2026-07-24 04:46:05+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...