CVE-2026-84023

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page...

CVE-2026-84023 BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page...

EUVD-2026-76790

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page...

WordPress BEAR plugin < 1.2.2 - Taxonomy Term Modification vulnerability

Taxonomy Term Modification vulnerability discovered by Ali Mousavi in WordPress Plugin BEAR versions 1.2.2...

CVE-2026-84023 BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page...

CVE-2026-84023

The BEAR - Bulk Editor and Products Manager Professional for WooCommerce WordPress plugin is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 1.2.2 . The root cause is a failure to verify a CSRF nonce or check user capabilities when updating taxonomy terms. An attacke...

CVE-2026-84023: Cross-Site Request Forgery (CSRF)

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page...

PT-2026-90574

I discovered a CSRF vulnerability in BEAR – Bulk Editor and Products Manager Professional for WooCommerce. CVE-2026-84023 — Taxonomy Term Modification via CSRF Affected versions: 1.2.2 Fixed in: 1.2.2 https://t.co/VqYeibaeDi BugBounty CyberSecurity CVE WordPress...

DRUPAL-CONTRIB-2026-152

This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise...

WordPress TP Restore Categories And Taxonomies plugin <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Taxonomy Deletion vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin TP Restore Categories And Taxonomies versions = 1.0.1...

EUVD-2026-72365

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-12853: Missing Authorization

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

PT-2026-86751

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-84901

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...

EUVD-2026-71868

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...

WordPress Eventin plugin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability

Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event Solution versions 4.1.22...

CVE-2026-84901 Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...

CVE-2026-84901

The Eventin WordPress plugin (versions before 4.1.22 ) contains a missing authorization vulnerability in several event-management REST routes . This flaw allows users with contributor-level access or higher to perform unauthorized actions, including changing the site's front-page setting to an ev...

CVE-2026-84901 Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...

PT-2026-86352

🚨 CVE-2026-84901 The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and dele...