PT-2026-95781

Name of the Vulnerable Software and Affected Versions Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization versions prior to 2.6.24 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform...

PT-2026-95788

Name of the Vulnerable Software and Affected Versions Bread plugin for WordPress versions prior to 2.9.13 Description Information exposure occurs due to missing authentication and authorization checks in the settings export functionality. The download settings function, registered on the plugins...

PT-2026-95785

Name of the Vulnerable Software and Affected Versions VW Writer Blog theme for WordPress versions prior to 1.3.9 Description The software allows unauthorized modification of data because the vw writer blog reset all settings function lacks a proper capability check. Authenticated users with...

CVE-2026-2278: Missing Authorization

The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vwwriterblogresetallsettings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2026-12042: Improper Neutralization of Input During Web Page Generation

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-15946: Missing Authorization

The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an...

WordPress Partial Shipment for WooCommerce plugin <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Settings Modification vulnerability discovered by Muhan Luo in WordPress Plugin Woocommerce Partial Shipment versions = 3.4...

UBUNTU-CVE-2026-93492

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAXHEADERTABLESIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimatel...

EUVD-2026-82903

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAXHEADERTABLESIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimatel...

CVE-2026-18317 Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-88825

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and ...

EUVD-2026-82677

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and ...

CVE-2026-88825 iGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and ...

CVE-2026-88825 iGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and ...

CVE-2026-88825

The iGMS Direct Booking WordPress plugin (versions before 2.0 ) is vulnerable to an unauthenticated stored XSS flaw. The root cause is a failure to properly authorize or escape widget appearance settings. This allows unauthenticated users to store arbitrary web scripts that execute in the browser...

PT-2026-95250

Name of the Vulnerable Software and Affected Versions iGMS Direct Booking versions prior to 2.0 Description The plugin fails to authorize or escape widget appearance settings, enabling unauthenticated users to perform a Stored Cross-Site Scripting XSS attack. This allows the storage of arbitrary...

PT-2026-95268

Name of the Vulnerable Software and Affected Versions Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress versions prior to 2.5.4 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform...

CVE-2026-88825: Improper Neutralization of Input During Web Page Generation

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and ...

Autodesk Fusion 360 <= 2704.1.53 MITM (adsk-sa-2026-0016)

The version of Autodesk Fusion 360 installed on the remote host is less than or equal to 2704.1.53. It is, therefore, affected by a man-in-the-middle vulnerability: - A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings...

CVE-2026-92756 Combining encryption settings may disable encryption

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database...