26724 matches found
CVE-2026-5582
The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...
CVE-2026-5582 FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle
The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...
CVE-2026-5582 FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle
The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...
EUVD-2026-51096
The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...
ROOT-APP-NPM-CVE-2026-55180 CVE-2026-55180 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-55180 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
GHSA-M4X6-GWGP-4PM7
creationtimestamp| type| source ---|---|--- 2026-07-30 09:32:05+00:00| seen| https://gist.github.com/alon710/7771115a3d9e03361e58ecd1b540d28d...
CVE-2026-67248
creationtimestamp| type| source ---|---|--- 2026-07-30 06:45:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/23bhethvirrjs 2026-08-04 14:26:13+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msb7rxlqal2c 2026-08-05 17:37:06+00:00| seen|...
GHSA-PM5P-7W5H-JM5Q
creationtimestamp| type| source ---|---|--- 2026-07-30 06:31:29+00:00| seen| https://gist.github.com/alon710/5f2d10f3a54edb2e4c4f46ec9659b74e...
CVE-2026-15054
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...
CVE-2026-13178
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...
CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...
CVE-2026-13143
The WP Travel WordPress plugin versions before 11.8.1 are vulnerable to an unauthenticated payment bypass. The root cause is a failure to verify PayPal Instant Payment Notifications through the required PayPal post-back handshake before marking a booking as paid. This allows unauthenticated attac...
CVE-2026-13178
The Eventin (also identified as WP Event Solution ) WordPress plugin, specifically versions prior to 4.1.16 , contains an unauthenticated payment bypass vulnerability. The flaw stems from improper authorization during order creation, where the plugin accepts an attacker-supplied order status . Th...
EUVD-2026-51009
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...
CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...
CVE-2026-13178
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...
CVE-2026-13143
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at ...
CVE-2026-15054
The Bit Form WordPress plugin (versions before 3.1.2 ) contains a vulnerability where public form-submission handlers fail to verify if a form is currently active or published. This oversight allows unauthenticated users to submit entries to deactivated or unpublished forms, which can trigger con...
CVE-2026-48448
creationtimestamp| type| source ---|---|--- 2026-07-30 04:00:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrtki7wira23 2026-08-01 11:00:24+00:00| seen| https://bsky.app/profile/hendryadrian.bsky.social/post/3mrzcv5vr7s2e 2026-08-04 11:12:11+00:00| seen|...