CVE-2026-7726 Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action

The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...

CVE-2018-16363

The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wpfilemanager request because settransient is used in filefoldermanager.php and there is an echo of lang in lib\wpfilemanager.php...