CVE-2026-86786 Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as wel...

WordPress Slider Pro plugin <= 1.0.0 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Seongwon Lee in WordPress Plugin Slider Pro versions = 1.0.0...

CVE-2026-86786

The Slider Pro WordPress plugin (versions through 1.0.0 ) is vulnerable to an Unauthenticated Sensitive Data Disclosure due to a lack of capability or authorization checks on one of its AJAX actions. An unauthenticated attacker can exploit this to retrieve the title, excerpt, and permalink of non...

AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

CVE-2020-8193

Citrix ADC Vulns CVE List https://support.citrix.com/article/CTX276688 Add if while Code https://dmaasland.github.io/posts/citrix.html responsestr = json.dumpsr.headers.dict'store' if r.statuscode == 406 and "Content-Disposition" in responsestr and r.headers"Accept-Ranges" == "bytes" and...

CVE-2026-86817

The Five Star Business Profile and Schema WordPress plugin (versions 2.3.20-2.3.21 ) is vulnerable to a sensitive data disclosure flaw. The issue stems from the plugin failing to properly restrict callbacks used to resolve schema field default values. This allows authenticated users with Author-l...

WordPress Five Star Business Profile and Schema plugin 2.3.20-2.3.21 - Author+ Sensitive Data Disclosure vulnerability

Author+ Sensitive Data Disclosure vulnerability discovered by Artus KG in WordPress Plugin Five Star Business Profile and Schema versions 2.3.20-2.3.21...

CVE-2026-86817 Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' passwo...

CVE-2026-101148

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

CVE-2026-101148 BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

CVE-2026-101148

The BackupSheep WordPress Backup Plugin (versions through 1.8 ) is vulnerable to unauthenticated access due to improper validation of its integration key . The plugin treats unset or blank keys as valid, enabling attackers to create and download full site backups —including databases with user pa...

CVE-2026-101148 BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

EUVD-2026-90507

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

PT-2026-103694

Name of the Vulnerable Software and Affected Versions BackupSheep WordPress Backup Plugin versions prior to 1.9 Description The plugin fails to properly validate its integration key, treating a blank or unset key as valid. This allows unauthenticated attackers to access backup and export endpoint...

CVE-2026-101148: External Control of File Name or Path

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

WordPress YayReviews plugin 1.0.4-1.4.0 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin YayReviews versions 1.0.4-1.4.0...

CVE-2026-94274 YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content...

CVE-2026-94274

The YayReviews WordPress plugin, in versions prior to 1.4.1 , contains a vulnerability where it fails to restrict access to an API route designed to return individual customer review records. This oversight allows unauthenticated attackers to harvest sensitive data, including reviewers' email add...

CVE-2026-94274 YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content...

CVE-2026-100669

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config IIS, every deny rule usersensitivefolders, useraccounts, userdata, usererrorredirect, userpages, system, vendor, ignorefolders sets...