CVE-2026-81196

The MasterStudy LMS WordPress plugin before 3.7.46 fails to properly verify ownership of quiz question identifiers, an IDOR flaw that lets any user with instructor-level access read other instructors' quiz questions, including correct answers and explanations . The CVSS 3.1 score is 2.7 (Low) , r...

CVE-2026-81194

MasterStudy LMS WordPress Plugin (versions before 3.7.46 ) contains an authorization bypass in its order line-item retrieval endpoint. By supplying another user's identifier (the author_id parameter), any authenticated user—including low-privilege Subscribers —can read other instructors' course s...

CVE-2026-80467

CVE-2026-80467 affects the Advanced Custom Fields: Extended WordPress plugin, versions 0.9.2.2 through 0.9.2.6 . The plugin's front-end user insert forms fail to restrict the role submitted to those the form actually offers, and its safeguard against privileged roles is incomplete. This allows un...

CVE-2026-79621

The CatalogX (Product Catalog Enquiry for WooCommerce) WordPress plugin by MultiVendorX, prior to 6.1.3 , fails to sanitise or escape content that an unauthenticated user can store (via a shared transient), allowing arbitrary content injection into the product enquiry notification email sent to t...

CVE-2026-81197

The MasterStudy LMS WordPress plugin (versions before 3.7.46 ) contains an Unauthenticated Unpublished Course Title Disclosure vulnerability. The plugin's course-list REST route does not restrict access nor filter results by publication status, allowing unauthenticated users to retrieve the title...

CVE-2026-81195

The MasterStudy LMS WordPress plugin (versions before 3.7.46 ) lacks an authorization check on the student-courses REST route , allowing unauthenticated attackers to retrieve per-student course enrollment and learning progress data for any registered user. The vulnerability was discovered by Abdu...

CVE-2026-78151

The FormLayer WordPress plugin (versions before 1.0.9 ) contains an unauthenticated information disclosure vulnerability discovered by Vaibhav Narkhede . The plugin's public form submission handler returns a form's full stored configuration in its response without performing any authorization che...

CVE-2026-77785

The Rank Math SEO WordPress plugin prior to 1.0.277 is vulnerable to an Author+ non-public post content disclosure via its Abilities API . The plugin fails to verify whether the requesting user is permitted to read a specific post before returning its content and SEO metadata, allowing any user w...

CVE-2026-77788

The Rank Math SEO WordPress plugin before 1.0.277 contains an insufficient authorization check in the updateSchemas function. The plugin does not verify that the metadata row being updated belongs to the object the user was authorized against, allowing users with the Author role or higher to over...

CVE-2026-77787

The Rank Math SEO WordPress plugin (versions before 1.0.277 ) contains an improper access control flaw in its updateMetaBulk function. When bulk metadata updates target taxonomy terms, the plugin fails to perform a capability check and reuses the supplied object identifier across object types. Th...

CVE-2026-77783

The Rank Math SEO WordPress plugin (versions before 1.0.277 ) fails to verify that a post's schema is publicly viewable before rendering it on the front end. This allows unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled, and password-prot...

CVE-2026-77784

Rank Math SEO (WordPress plugin) versions before 1.0.277 suffer from an authorization bypass in the mark_page_as function: the plugin does not verify that the requesting user is permitted to edit the target object before updating its SEO indexing metadata (Robots and Pillar Content settings). An ...

CVE-2026-77792

The RegistrationMagic WordPress plugin before 6.0.9.9 contains an unauthenticated Stored Cross-Site Scripting vulnerability. A registration form field value (specifically the Rating field) is not escaped before being output in an HTML attribute on an administrative page, allowing an unauthenticat...

CVE-2026-77782

The Rank Math SEO WordPress plugin, versions before 1.0.277.1 , fails to check whether a post is password-protected before using its content to build publicly generated SEO metadata (via post metadata and llms.txt ). This allows unauthenticated users to read the content of password-protected post...

CVE-2026-19719

CVE-2026-19719 affects the Social Media Share Buttons & Social Sharing Icons WordPress plugin (versions before 3.0.1 ). The vulnerability is a Stored Cross-Site Scripting (XSS) caused by an unescaped post title being output into an inline JavaScript event handler. Exploitation requires a user wit...

CVE-2026-74927

MultiVendorX WordPress plugin (versions 5.0.13–5.0.14 ) lacks proper authorization on its stores REST endpoint , enabling unauthenticated attackers to retrieve vendor contact information, payout details, pending payout amounts, and administrative notes attached to store applications. The issue is...

CVE-2026-19704

wpDiscuz (the Comments WordPress plugin) versions before 7.6.66 are vulnerable to an unauthenticated SQL injection caused by an unvalidated value used to build a database query. The injected text is interpreted as SQL grammar rather than as data, so an unauthenticated attacker can read comments t...

CVE-2026-77764

The GamiPress WordPress plugin before version 7.9.9.6 does not properly restrict its video watch-tracking functionality . A user with the Subscriber role (the lowest default WordPress role) can award configured gamification points, achievements, and ranks to arbitrary users—including administrato...

CVE-2026-19723

The Social Media Share Buttons & Social Sharing Icons WordPress plugin (before 3.0.1 ) contains a Reflected Cross-Site Scripting vulnerability via the Pin It Share Handler . The root cause is a failure to properly escape a value taken from the incoming request before outputting it in an inline Ja...

CVE-2026-19116

The User Frontend WordPress plugin before 4.3.11 allows PHP Object Injection via its frontend post editing form. When a submitted post is reopened, user-supplied field values are deserialized without proper sanitization, enabling any authenticated user with subscriber-level access or above to inj...

CVE-2026-19453

JetBackup WordPress plugin (versions 3.1.7.9 through 3.1.23.3) contains a privilege escalation vulnerability. The plugin fails to verify the role or capabilities of a preserved account before granting administrator privileges during a restore or migration, allowing a subscriber-level user to gain...

CVE-2026-16983

The Gutentor WordPress plugin (versions before 4.0.6 ) fails to apply the correct context restriction on one of its REST endpoints , exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role. The vulnerability was discovered by Ezekie...

CVE-2026-19251

The Ultimate Member WordPress plugin before 2.13.0 allows unauthenticated visitors to read comments still awaiting moderation by querying profile activity, due to a missing check on comment approval status and profile privacy. The vulnerability was discovered by Alessandro Greco (Aleff) and Giova...

CVE-2026-14215

CVE-2026-14215 affects the Booking for Appointments and Events Calendar WordPress plugin (also referred to as Amelia ) in versions prior to 2.4.9 . The root cause is a missing authentication or valid request token check before executing the post-booking action chain . An unauthenticated attacker ...

CVE-2026-16966

Solace Extra WordPress plugin before 1.7.0 has a missing authorization and post-status check in its get_elementor_content AJAX action. This allows unauthenticated visitors to read the content of non-published Site Builder parts (draft, pending, private, and trashed) that WordPress would normally ...

CVE-2025-15664

The Ultimate Before After Image Slider & Gallery (BEAF) WordPress plugin versions before 4.7.19 are affected by an Author+ Stored XSS . The root cause is that the slider's before-label value is not properly escaped before the plugin's bundled client-side script re-injects it into the DOM. An atta...

CVE-2026-12526

Advanced Custom Fields: Extended WordPress plugin versions before 0.9.2.7 contain an authorization bypass in the update-user action of its front-end Forms module. The plugin only enforces a capability check when the submitted role is administrator or super_admin , failing to verify that the reque...

CVE-2026-15232

The MotoPress Appointment Booking WordPress plugin before 2.4.8 lacks an authorization or ownership check when processing a user-supplied booking identifier on an unauthenticated endpoint , allowing attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9...

CVE-2026-12865

CVE-2026-12865 affects the Photo Gallery by 10Web WordPress plugin (before 1.8.44 ). Two request parameters (title and paged) are not escaped before being reflected into input-attribute values on admin pages (the Shortcode page and the Galleries/Albums list page). An unauthenticated attacker can ...

CVE-2025-15663

The Ultimate Before After Image Slider & Gallery (BEAF) WordPress plugin, in versions before 4.7.19 , suffers from a Stored XSS due to improper escaping of the slider's after-label value before the bundled client-side script re-injects it into the DOM. Users with the Author role or above can stor...

CVE-2026-33016

This CVE entry is currently reserved with no publicly available technical details. A sighting was recorded on 2026-09-02 from a Telegram channel (HackingTeamGrupoOfficial). Monitor for vendor announcement and further details.

CVE-2026-78657

The SigmaForms Pro – AI Generated Forms WordPress plugin (versions ≤ 1.4.11) is affected by an unauthenticated arbitrary file deletion vulnerability rooted in insufficient file path validation in the delete_submission_files function. An attacker submits a malicious path traversal URL via the plug...

CVE-2026-14357

The DevKit Pro plugin for WordPress is vulnerable to missing authorization in versions up to and including 2.3.0 . The root cause is a missing capability check and nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This allows authe...

CVE-2026-9055

CVE-2026-9055 affects the Amelia (Premium) booking plugin for WordPress in versions 8.0 through 9.6.2 , rated CVSS 9.8 (Critical) . The root cause is insufficient validation of the attacker-controlled type parameter in the customer update endpoint: when externalId is set to 0, a customer can set ...

CVE-2026-3851

The Divi theme for WordPress (versions up to 4.27.6 ) is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format. Two compounding flaws enable the attack: the save-time sanitization filter et_builder_sanitize_dynamic_content_fields() only checks for the @ET-...

CVE-2026-19754

CVE-2026-19754 is a SQL injection vulnerability in Baserow 2.3.3 , specifically in the index() formula function (used for JSONB array extraction). A low-privileged authenticated user who can create or modify formula fields can supply an undocumented fourth argument that is treated as a SQL templa...

CVE-2026-84442

A path traversal vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android, specifically in the function getDataColumn of the file ExpoShareIntentModule.kt within the component com.mapquest.android.ace. The attack must be approached locally and requires low privileges with no...

CVE-2026-14982

The WP File Download plugin for WordPress (versions ≤ 6.3.4 ) is vulnerable to arbitrary file deletion via insufficient path validation in the delete function. Authenticated attackers with subscriber-level access or above can exploit a two-stage attack : first calling the file.save endpoint to pe...

CVE-2026-14957

CVE-2026-14957 is a denial-of-service vulnerability in Libreswan (an IPsec/IKE implementation for Linux). In FIPS mode , the add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts the result is non-NULL. When public key extraction fails (e.g., RSA exponent set to 0), the assertion ...

CVE-2026-84441

Piwigo versions up to 16.3.0 are affected by a path traversal vulnerability in the Image Derivative Handler component, specifically in the file i.php . The vulnerable functionality is described as unknown, but manipulation of it allows an unauthenticated remote attacker to traverse the filesystem...

CVE-2026-84438

OpenCart 4.1.0.3 and 4.1.0.4 are affected by a stored cross-site scripting (XSS) vulnerability in the Autocomplete Workflow component, specifically in the file catalog/controller/account/edit.php. The vulnerability is triggered through manipulation of the firstname argument, allowing a remote, au...

CVE-2026-82968

Keycloak identity management service has a flaw in the first-broker-login flow that enables account takeover via social identity provider linking. The verification proof (described in the CVE list as a cross-session email verification proof ) is not strictly bound to the specific upstream identit...

CVE-2026-84437

A cross-site scripting (XSS) vulnerability affects OpenCart 4.1.0.3 and 4.1.0.4 , specifically in the Autocomplete Workflow component within the file catalog/controller/account/address.php. Manipulating the address_1 argument allows a remote, authenticated (low-privilege) attacker to inject scrip...

CVE-2026-84715

FeatherPanel versions before 1.3.7.10 contain a privilege escalation vulnerability in the SubuserController updateSubuser handler. The handler fails to properly validate permissions, allowing an authenticated subuser with minimal access to send a crafted request that modifies their own permission...

CVE-2026-84485

APITable versions through 1.13.0-beta.1 expose an internal organization loadOrSearch endpoint without requiring authentication. This allows unauthenticated attackers to retrieve member names, email addresses, and team hierarchy by querying the endpoint with space identifiers obtained from shared ...

CVE-2026-84484

ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function. An unauthenticated remote attacker can send a UDP datagram to the LTP link service input port with a truncated SDNV value, triggering reads up to nine bytes past buffer boundaries and underflowin...

CVE-2026-84431

A path traversal vulnerability exists in the AirAsia MOVE App (versions up to 12.47.1 on Android). The flaw resides in the function com.airasia.core.utils.RealPathUtil.getRealPath within the component com.airasia.mobile , where manipulation of the _display_name argument allows an attacker to trav...

CVE-2025-33141

This is a reserved CVE candidate with no publicly available technical details regarding the affected product, vulnerability type, or impact. Monitor for updates when the candidate is publicized.

CVE-2026-31278

CVE-2026-31278 affects Suprema BioStar 2 , a biometric access control system, involving the exposure of Active Directory credentials . The NVD entry is still in a reserved state, but a Kitploit tool entry and a CIRCL Telegram sighting (2026-09-02) indicate the vulnerability is being tracked. No s...

CVE-2025-52399

CVE-2025-52399 is a SQL Injection vulnerability in the Institute-of-Current-Students PHP application (version 1.0). The /loginlinkfaculty endpoint fails to sanitize the fid POST parameter before including it in a SQL query, enabling remote attackers to execute arbitrary SQL commands. Exploitation...