143830 matches found
CVE-2026-14195 Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts...
CVE-2026-67339: Exposure of Sensitive Information to an Unauthorized Actor
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle...
CVE-2025-14073: Authorization Bypass Through User-Controlled Key
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...
CVE-2026-2916: Exposure of Sensitive Information to an Unauthorized Actor
The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the enqueuescripts method in class/dashboard/class-dashboard.php. The plugin injects a JkitDashboardOption JavaScript object containing full plugin...
PT-2026-67125
Name of the Vulnerable Software and Affected Versions Advanced Views versions prior to 3.9.2 Description The plugin is susceptible to sensitive information exposure through the register rest routes function. Authenticated users with subscriber-level access or higher can extract admin-authored...
CVE-2026-17580: Missing Authorization
The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...
PT-2026-67196
Name of the Vulnerable Software and Affected Versions Jeg Kit for Elementor versions prior to 3.1.2 Description The plugin exposes sensitive information through the enqueue scripts function in class/dashboard/class-dashboard.php. It injects a JkitDashboardOption JavaScript object as an inline...
CVE-2026-18059: Exposure of Sensitive Information to an Unauthorized Actor
The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...
PT-2026-67128
The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...
WordPress WooCommerce PayPal Payments plugin <= 3.3.2 - Unauthenticated Sensitive Information Disclosure vulnerability
Unauthenticated Sensitive Information Disclosure vulnerability discovered by Drew Webber mcdruid in WordPress Plugin WooCommerce PayPal Payments versions = 3.3.2...
WordPress PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin < 12.6.1 - Unauthenticated Sensitive Information Exposure vulnerability
Unauthenticated Sensitive Information Exposure vulnerability discovered by Win3 in WordPress Plugin PixelYourSite PRO versions 12.6.1...
WordPress PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin <= 11.2.1 - Unauthenticated Sensitive Information Exposure vulnerability
Unauthenticated Sensitive Information Exposure vulnerability discovered by Win3 in WordPress Plugin PixelYourSite – Your smart PIXEL TAG Manager versions = 11.2.1...
WordPress Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information vulnerability
Authenticated Contributor+ Exposure of Sensitive Information vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Jeg Kit for Elementor versions = 3.1.1...
CVE-2026-34490 XAAP Android Data Stored in Unencrypted Database
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53...
CVE-2026-34490 XAAP Android Data Stored in Unencrypted Database
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53...
CVE-2026-34490
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53...
CVE-2026-34490
CVE-2026-34490 affects the XAAP Android application (pre-1.53). The issue is cleartext storage of sensitive data in an unencrypted local database on the device, allowing a local attacker on a jailbroken or otherwise compromised device to retrieve sensitive information. CVSS v4.0 base score 4.8 (M...
EUVD-2026-51576
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53...
