CVE-2026-85132

The WPLP Cookie Consent WordPress plugin (versions 4.0.2-4.4.1 ) is vulnerable to a disclosure of the automated scan schedule. The root cause is a failure to perform nonce or capability checks on a specific cookie scanner AJAX action, specifically via gcc_get_schedule_scan. This allows any authen...

WordPress WPLP Cookie Consent plugin 4.0.2-4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure vulnerability

Subscriber+ Cookie Scan Schedule Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.0.2-4.4.1...

Missing Authorization

Overview pterodactyl/panel is a game management panel. Affected versions of this package are vulnerable to Missing Authorization in StoreTaskRequest and ScheduleController::execute for schedule task handling in app/Http/Requests/Api/Client/Servers/Schedules/StoreTaskRequest.php and...

CVE-2026-86177 Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

CVE-2026-56128

pfSense Plus before 26.07 and pfSense CE before 2.9.0 contain a stored cross-site scripting vulnerability in the firewall schedule editor. Authenticated users with the Firewall: Schedules: Edit privilege can inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The v...

EUVD-2026-70498

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...

PT-2026-85053

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall schedule edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into a...

CVE-2026-84764

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...

EUVD-2026-69937

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...

CVE-2026-84764 WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...

CVE-2026-84764 WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...

CVE-2026-84764

CVE-2026-84764 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Simply Schedule Appointments , affecting versions 1.6.12.23 and below . The flaw was discovered by Anthony Green of Greenhat Security . The assigned CVSS 3.1 score is 8.8 (High) , reflecti...

WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Anthony Green of Greenhat Security in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.23...

CVE-2026-84764: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...

PT-2026-84699

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...

CVE-2026-84477

AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...

CVE-2026-84477 AVideo Stored XSS via Live Schedule Title Description

AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...

CVE-2026-84477 AVideo Stored XSS via Live Schedule Title Description

AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...

CVE-2026-84477

AVideo is vulnerable to a stored XSS in its live scheduling feature. The functions Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can subsequently access remindMe...

CVE-2026-84477 AVideo Stored XSS via Live Schedule Title Description

AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...