PT-2026-133633

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including...

WordPress WP Posts Password Batch Manager plugin <= 1.1 - Unauthenticated Bulk Post Password Rewrite vulnerability

Unauthenticated Bulk Post Password Rewrite vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WP Posts Password Batch Manager versions = 1.1...

CVE-2026-89283

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing...

CVE-2026-89283 WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing...

CVE-2026-89283

The WP Posts Password Batch Manager WordPress plugin, in versions through 1.1 , contains a vulnerability where it fails to perform capability or nonce checks on a bulk post-password action. This action runs on an always-loaded admin handler , enabling unauthenticated attackers to reset or overwri...

CVE-2026-89283 WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing...

EUVD-2026-96785

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing...

PT-2026-110058

Name of the Vulnerable Software and Affected Versions WP Posts Password Batch Manager versions prior to 1.2 Description The plugin fails to perform capability or nonce checks on a bulk post-password action executed via an always-loaded admin handler. This allows unauthenticated attackers to reset...

CVE-2026-89283: Missing Authorization

The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing...

CVE-2026-1378 WP Posts Re-order <= 1.0 - Cross-Site Request Forgery to Settings Update

The WP Posts Re-order plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the cptpluginoptions function. This makes it possible for unauthenticated attackers to update the plugin settings including...

CVE-2026-1378: Cross-Site Request Forgery (CSRF)

The WP Posts Re-order plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the cptpluginoptions function. This makes it possible for unauthenticated attackers to update the plugin settings including...

CVE-2025-12002

The Feeds for YouTube Pro plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.6.0 via the 'sbycheckwpsubmit' AJAX action. This is due to insufficient sanitization of user-supplied data and the use of that data in a file operation. This makes it possib...

CVE-2025-12002

The Feeds for YouTube Pro plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.6.0 via the 'sbycheckwpsubmit' AJAX action. This is due to insufficient sanitization of user-supplied data and the use of that data in a file operation. This makes it possib...

EUVD-2026-3158

The Feeds for YouTube Pro plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.6.0 via the 'sbycheckwpsubmit' AJAX action. This is due to insufficient sanitization of user-supplied data and the use of that data in a file operation. This makes it possib...

EUVD-2025-17125

Malicious code in bioql PyPI...

EUVD-2025-11306

Malicious code in bioql PyPI...

EUVD-2025-8572

Malicious code in bioql PyPI...

EUVD-2025-8292

Malicious code in bioql PyPI...

CVE-2025-52802

CVE-2025-52802 describes a Missing Authorization / Broken Access Control vulnerability in the WordPress plugin “Import YouTube videos as WP Posts” (versions n/a–2.1). The issue arises from incorrectly configured access control, enabling unauthorized actions that affect WP Posts created via the pl...

CVE-2025-52802: Missing Authorization

Missing Authorization vulnerability in enguerranws Import YouTube videos as WP Posts import-youtube-videos-as-wp-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import YouTube videos as WP Posts: from n/a through = 2.1...