CVE-2026-4432

The YITH WooCommerce Wishlist WordPress plugin (versions before 4.13.0 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The save_title() AJAX handler fails to properly validate wishlist ownership during renaming operations, relying only on a nonce that is publicly exposed in th...

CVE-2025-55795

The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflows. An authenticated attacker controlling a user account with a lower user ID can update their email address to that of another user with ...