24135 matches found
CVE-2026-13228
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.6.3 This is due to an Insecure Direct Object Reference IDOR in the createorupdate function of OsOrdersController, whi...
CVE-2026-13228
The vulnerability CVE-2026-13228 affects the LatePoint – Calendar Booking Plugin for Appointments and Events (WordPress). An Insecure Direct Object Reference (IDOR) in OsOrdersController.create_or_update enables an authenticated Agent (low privileges) to specify an arbitrary order[customer_id] an...
EUVD-2026-40943
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.6.3 This is due to an Insecure Direct Object Reference IDOR in the createorupdate function of OsOrdersController, whi...
CGA-7V8C-M37Q-3482
Bulletin has no description...
CGA-PJ38-X537-FP45
Bulletin has no description...
CGA-R9WF-46RJ-GW44
Bulletin has no description...
CGA-WVFM-RJC7-4989
Bulletin has no description...
CGA-XXHQ-732W-2FVF
Bulletin has no description...
CGA-8499-CVF4-HM4C
Bulletin has no description...
CGA-45GC-MXG7-39J4
Bulletin has no description...
CGA-QVQF-8R2W-PPFM
Bulletin has no description...
CGA-9G9V-2MXW-FQ79
Bulletin has no description...
CGA-2WRJ-X522-7J97
Bulletin has no description...
CGA-PG56-J8V3-88VX
Bulletin has no description...
ECHO-E657-17CF-15C8
Bulletin has no description...
CVE-2026-10096
The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'pageid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, t...
CVE-2026-10096
The Qi Blocks WordPress plugin is vulnerable to Insecure Direct Object Reference in all versions up to and including 1.4.9 via the page_id parameter. Authenticated users with author-level access can modify stored Qi Blocks styles on arbitrary posts, templates, or widgets, including site-wide surf...
EUVD-2026-40936
The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'pageid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, t...
CVE-2026-10096 Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter
The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'pageid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, t...