CVE-2026-82851 Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...

EUVD-2026-76788

The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators...

CVE-2026-82847 Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights

The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators...

CVE-2026-84023

The BEAR - Bulk Editor and Products Manager Professional for WooCommerce WordPress plugin is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 1.2.2 . The root cause is a failure to verify a CSRF nonce or check user capabilities when updating taxonomy terms. An attacke...

CVE-2026-82851

The Masteriyo LMS WordPress plugin (versions 1.14.0-3.4.0 ) contains an Insecure Direct Object Reference (IDOR) vulnerability. The plugin fails to verify ownership or restrict the type of records a user requests for download. This allows users with the instructor role to retrieve the full content...

CVE-2026-84025

The BEAR (Bulk Editor and Products Manager Professional for WooCommerce) WordPress plugin versions before 1.2.2 is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to perform sufficient ownership checks on several handlers that return product data based on a user-suppli...

CVE-2026-82847

The Masteriyo LMS WordPress plugin (versions before 3.4.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape one of the course fields before it is outputted back within the course editor. This flaw allows users with the instructor ...

EUVD-2026-76790

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page...

CVE-2026-82847 Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights

The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators...

CVE-2026-82851 Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...

EUVD-2026-76785

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via...

CVE-2026-81402 DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload

The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code...

CVE-2026-81742 BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-82845 Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

CVE-2026-81429

The Export & Import WPBakery Page Builder WordPress plugin (versions through 1.0.2 ) is vulnerable to a CSRF to Stored Cross-Site Scripting flaw. The issue arises because the template-import feature fails to perform CSRF checks and does not sanitise imported data before storing and echoing it. An...

CVE-2026-81402 DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload

The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code...

CVE-2026-81742

The BE REST Endpoints WordPress plugin, in versions through 1.0.0 , is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) and widget manipulation . The root cause is a failure to perform authorization checks before allowing widgets to be read, created, updated, or deleted, combined w...

EUVD-2026-76786

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-82845

The Masteriyo LMS WordPress plugin (versions before 3.4.1 ) is vulnerable to PHP Object Injection due to the failure to prevent deserialization of user-supplied values held as metadata. An attacker with a minimal account can inject arbitrary PHP objects, leveraging a class in a bundled library to...

CVE-2026-81402

The DS Ad Rotator WordPress plugin (versions through 0.8 ) is vulnerable to an unauthenticated arbitrary file upload vulnerability. The issue stems from a lack of capability checks, nonce verification, and file-type validation within the plugin's image upload handler . This allows unauthenticated...