CVE-2026-62033

Subscriber Settings Change in uListing = 2.2.0 versions...

CVE-2026-40802

Subscriber Settings Change in Pubjet | پاب‌جت = 5.4.8 versions...

CVE-2026-62033

The uListing WordPress plugin, version 2.2.0 and below , is affected by a Subscriber Settings Change vulnerability. The issue is characterized as a Missing Authorization flaw (CWE-862), allowing for unauthorized modifications to settings. The vulnerability has a High severity base score of 7.6, i...

CVE-2026-62033 WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability

Subscriber Settings Change in uListing = 2.2.0 versions...

EUVD-2026-96468

Subscriber Settings Change in uListing = 2.2.0 versions...

CVE-2026-40802

The WordPress Pubjet | پاب‌جت plugin (versions

CVE-2026-40802 WordPress Pubjet | پاب‌جت plugin <= 5.4.8 - Settings Change vulnerability

Subscriber Settings Change in Pubjet | پاب‌جت = 5.4.8 versions...

EUVD-2026-96539

Subscriber Settings Change in Pubjet | پاب‌جت = 5.4.8 versions...

CVE-2026-108593

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and...

CVE-2026-108593 9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and...

CVE-2026-108593

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and...

EUVD-2026-96401

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and...

CVE-2026-108593

The software 9router (versions 0.4.1 through 0.5.99 ) is vulnerable to a configuration injection vulnerability within the POST /api/cli-tools/hermes-settings endpoint. Authenticated dashboard users can exploit this by submitting a baseUrl containing double quotes and newlines, allowing them to in...

CVE-2023-6289

CVE-2023-6289 Swift Performance Lite = 2.3.6.14 - Missing Authorization to Unauthenticated Settings Export Description The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the on functionality hooked via admininit functi...

CVE-2026-15178

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access an...

EUVD-2026-96226

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access an...

CVE-2026-104742

The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-104752

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution...

CVE-2026-107323

The Gallery PhotoBlocks WordPress plugin versions before 1.3.6 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape specific gallery settings before they are rendered into an HTML attribute. This allows users with Contributor-level acc...

CVE-2026-104752 Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution...