WordPress Product XML Feed Manager for WooCommerce plugin < 3.1.1 - Contributor+ Arbitrary Product Deletion vulnerability

Contributor+ Arbitrary Product Deletion vulnerability discovered by Abdullah Kareem cyberkareem in WordPress Plugin Product XML Feed Manager for WooCommerce versions 3.1.1...

CVE-2026-87919 Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...

CVE-2026-87919

The Product XML Feed Manager for WooCommerce WordPress plugin, in versions prior to 3.1.1 , contains a vulnerability that allows for arbitrary WooCommerce product deletion . The issue arises because the plugin's product shortcode fails to restrict which object methods it can call and does not ver...

EUVD-2026-76807

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...

CVE-2026-87919 Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...

CVE-2026-77753 Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

CVE-2026-77753

The Temporary Login Without Password WordPress plugin versions prior to 1.9.9 contains an authenticated temporary access revocation bypass. The plugin fails to prevent temporary users from creating Application Passwords and does not revoke these credentials once the temporary access expires or is...

[SECURITY] Fedora 43 Update: mingw-expat-2.8.4-1.fc43

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

[SECURITY] Fedora 44 Update: mingw-expat-2.8.4-1.fc44

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

CVE-2026-87919: Missing Authorization

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...

PT-2026-90562

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

CVE-2026-77753: Improper Access Control

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

Linux Distros Unpatched Vulnerability : CVE-2026-68497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to...

PT-2026-90591

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...

[SECURITY] Fedora 45 Update: mingw-expat-2.8.4-1.fc45

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

[SECURITY] Fedora 45 Update: perl-XML-Bare-0.53-47.fc45

This module is a 'Bare' XML parser. It is implemented in C. The parser itself is a simple state engine that is less than 500 lines of C. The parser builds a C struct tree from input text. That C struct tree is converted to a Perl hash by a Perl function that makes basic calls back to the C to go...

[SECURITY] Fedora 45 Update: expat-2.8.3-1.fc45

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

CVE-2026-18061

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-18061

An XML External Entity (XXE) vulnerability exists in the RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper versions 3.3.0 through 4.2.0 . An actor with write access to the shared cache infrastructure can inject crafted XML data into a cached column value, allowing them to disclose sensitive fil...

CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...