CVE-2022-1388

Vieux exploit que j'ai oublié de publier...

CVE-2026-93662 Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...

WordPress Events Manager plugin 7.4.1-7.4.4 - Subscriber+ Unpublished Event and Location Disclosure vulnerability

Subscriber+ Unpublished Event and Location Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Events Manager versions 7.4.1-7.4.4...

PT-2026-97720

Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.4.5 Description An issue exists in the Events Manager WordPress plugin where the scope of logged-in event and location searches is not enforced when a user provides a custom owner value. This allows a...

CVE-2026-93662: Exposure of Sensitive Information to an Unauthorized Actor

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...

CVE-2026-86602

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...

WordPress Event Booking Manager for WooCommerce plugin 5.3.6-5.7.2 - Contributor+ Unpublished Event Disclosure vulnerability

Contributor+ Unpublished Event Disclosure vulnerability discovered by Artus KG in WordPress Plugin WpEvently versions 5.3.6-5.7.2...

CVE-2026-91077 Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

CVE-2026-91077 Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

EUVD-2026-85043

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...

EUVD-2026-85042

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...

EUVD-2026-85038

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published...

CVE-2026-86603: Exposure of Sensitive Information to an Unauthorized Actor

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...

CVE-2026-93952

creationtimestamp| type| source ---|---|--- 2026-09-22 07:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mw3qipnnvk2t 2026-09-22 09:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117313871866403815 2026-09-22 09:00:28+00:00| seen|...

CVE-2026-93455 django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

WP < 7.1.1 - Contributor+ Unpublished Post Title Disclosure

Description WordPress does not check that the user is allowed to access a post before returning its sample permalink in some cases, which could allow users with a role as low as contributor to retrieve the titles of other users' draft and pending posts...

WordPress LearnPress plugin 4.2.7.1-4.4.6 - Unauthenticated Unpublished Course Disclosure vulnerability

Unauthenticated Unpublished Course Disclosure vulnerability discovered by Sai Praneeth Koti in WordPress Plugin LearnPress versions 4.2.7.1-4.4.6...

CVE-2026-86449

The LearnPress WordPress plugin (versions 4.2.7.1-4.4.6 ) is vulnerable to an unauthenticated information disclosure flaw. The root cause is a failure to verify user capabilities before applying a user-supplied post status filter within one of its REST routes . This allows unauthenticated attacke...

CVE-2026-89026

creationtimestamp| type| source ---|---|--- 2026-09-15 18:08:59+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvl7sxnjy62j 2026-09-15 18:20:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlagwcy572w 2026-09-16 13:16:18+00:00| seen|...

CVE-2026-91998

creationtimestamp| type| source ---|---|--- 2026-09-15 13:27:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6qzzxavbnrej6 2026-09-15 14:08:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvksenru5t2f 2026-09-15 17:30:04+00:00| seen|...