CVE-2026-116610

The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLoginShortcode::getpageswithshortcodes function hooked to the savepost action. This makes it possible for authenticated attackers, wit...

CVE-2026-116610 Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook

The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLoginShortcode::getpageswithshortcodes function hooked to the savepost action. This makes it possible for authenticated attackers, wit...

CVE-2026-116610 Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook

The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLoginShortcode::getpageswithshortcodes function hooked to the savepost action. This makes it possible for authenticated attackers, wit...

EUVD-2026-111597

The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLoginShortcode::getpageswithshortcodes function hooked to the savepost action. This makes it possible for authenticated attackers, wit...

CVE-2026-116610

The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.20.1 . The root cause is a missing capability check in the CleanLogin_Shortcode::get_pages_with_shortcodes() function, which is hooked to the save_post action. This allows authenticated a...

CVE-2026-75017

The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized t...

EUVD-2026-82728

The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized t...

CVE-2026-75017

CVE-2026-75017 affects the Magazine Blocks WordPress plugin in all versions up to and including 1.8.6 . The vulnerability is an authorization bypass caused by the mzb-builder-template post type being registered with capability_type='post' and exposed via the REST API, allowing any user with Contr...

CVE-2011-5318: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in diafan.CMS before 5.1 allow remote attackers to hijack the authentication of administrators for requests that 1 modify articles via a savepost action to admin/news/saveNEWSID/, 2 modify settings via a savepost action to admin/site/save2/...