By-Poloss..-..CVE-2026-11912

CVE-2026-11912: Simple File List eeListSettings'Allow...

WordPress Easy Appointments plugin 4.0-4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion vulnerability

Unauthenticated Arbitrary Appointment Modification and Deletion vulnerability discovered by blast in WordPress Plugin Easy Appointments versions 4.0-4.0.2.1...

CVE-2026-85104 Brain stimulation parameters can be modified via Bluetooth in Sooma

In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters...

EUVD-2026-76836

The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers including dtlmssavepocsettings, dtlmssaveskinsettings, and dtlmssaveoptionssettings in versions up to, and including, 1.1. Thes...

CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

EUVD-2026-75936

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

EUVD-2026-75726

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 v2, v3 & v5 and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials...

CVE-2026-51668

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-13404 Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-13404

The Royal Addons for Elementor WordPress plugin (versions before 1.7.1066 ) is vulnerable to an authorization bypass. The software fails to perform proper capability or ownership checks when writing like-count and visitor-tracking post meta, relying instead on a publicly-scrapeable nonce . This f...

CVE-2026-79661 Ech0 before 4.7.3 Unauthenticated fav_count Modification

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

CVE-2026-79661 Ech0 before 4.7.3 Unauthenticated fav_count Modification

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

CVE-2026-76609

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

CVE-2026-76609 Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

EUVD-2026-64318

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

PT-2026-79585

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description An issue exists where the 'onUpdateComment' endpoint does not perform necessary access checks, allowing unauthenticated users to modify any comment. Recommendations Update to version 4.7.2 or later...

CVE-2026-76609: Improper Access Control

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

EUVD-2026-53285

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...

WordPress Tablesome Table plugin < 1.1.31 - Unauthenticated Post Creation and Modification vulnerability

Unauthenticated Post Creation and Modification vulnerability discovered by Kim Dvash in WordPress Plugin Tablesome versions 1.1.31...

CVE-2026-14843 Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR

The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to...