CVE-2026-78252

GitLab CE/EE versions from 15.3 before 19.1.8 , 19.2 before 19.2.6 , and 19.3 before 19.3.2 are affected by improper sanitization of user-controlled data in the Markdown JSON table renderer . Under certain conditions, an authenticated user could induce a targeted user to perform unintended state-...

CVE-2026-79708

CVE-2026-79708 is an incorrect authorization flaw in GitLab EE affecting versions 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Due to insufficient scope validation , an authenticated user with developer permissions could execute a policy test pipeline on projects within their g...

CVE-2026-86475

Appointment Hour Booking is a WordPress plugin that allows scheduling of time-based appointments. Versions prior to 1.5.95 are affected by a capacity validation flaw: when a multi-appointment booking submission is received, the plugin does not verify each individual appointment against the capaci...

CVE-2026-84906

Eventin WordPress plugin versions before 4.1.24 contain an unauthenticated payment bypass affecting its Stripe and PayPal integrations. The plugin fails to verify that a completed payment corresponds to the specific order it is applied to, checking only that the gateway reports the transaction as...

CVE-2026-19857

The Formidable Forms WordPress plugin before version 6.35 is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is that a request-derived value can reach the WordPress shortcode parser when the plugin substitutes the [entry_key] token into a form's custom HTML, allowing ...

CVE-2026-13407

CVE-2026-13407 affects the Royal Elementor Addons WordPress plugin in versions before 1.7.1067 . The form widget does not properly sanitize and escape submitted values before including them in administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emai...

CVE-2026-73447

CVE-2026-73447 is a CRITICAL (CVSS 3.1: 9.1) OS command injection (CWE-78) in the gNSI Certz and Bootz services on Arista EOS . An authenticated user can escalate privileges to root via a crafted Certz Rotate request, leading to full device compromise . Affected versions span the 4.30.x through 4...

CVE-2026-89327

CVE-2026-89327 affects the FluentBoards WordPress plugin in versions prior to 2.0.15 . The root cause is a missing validation on the comment_by parameter: the plugin does not verify that the board member submitting a comment is actually the user the comment is attributed to. This allows any user ...

CVE-2026-87896

CVE-2026-87896 affects the Rox Appointment Booking WordPress plugin in versions prior to 1.2.8 . The vulnerability stems from a missing authorization check on a REST endpoint that returns booking agent (staff) records, allowing unauthenticated attackers to read sensitive staff data including emai...

CVE-2026-88910

kboard , a WordPress plugin for forum/notice board functionality, is vulnerable in versions before 6.7 to an unauthenticated IDOR (Insecure Direct Object Reference) flaw in its board media deletion endpoint. The plugin fails to verify ownership or context before processing a media deletion reques...

CVE-2026-87959

The WPBot WordPress plugin (versions 8.7.2–8.7.5 ) contains a missing capability check on the AJAX action that saves its Claude AI provider settings . This allows users with subscriber-level access to overwrite those settings, including the API key used for the plugin's outgoing AI requests, as d...

CVE-2026-89328

The FluentBoards WordPress plugin prior to 2.0.15 contains a privilege-escalation flaw in its board-management logic. The plugin checks only board membership rather than verifying board-manager privileges before allowing several management operations. As a result, any board member can perform man...

CVE-2026-87907

CVE-2026-87907 affects the Rox Appointment Booking WordPress plugin in versions prior to 1.2.8 . The root cause is a missing authorization check on the REST endpoints that return booking service and category records. This allows unauthenticated attackers to read private internal notes stored on e...

CVE-2026-87828

Seraphinite Accelerator is a WordPress plugin that, in versions before 2.29.24 , fails to perform a capability check on its seraph_accel_State Update AJAX action. An authenticated user with at least Subscriber level can write a malformed value through this action, triggering an uncaught error on ...

CVE-2026-87854

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints , enabling unauthenticated users to retrieve the store's full subscription list, including customer usernames, product names, recurring amounts, and p...

CVE-2026-87860

CVE-2026-87860 affects the Subscriptions for WooCommerce WordPress plugin in versions before 2.0.3 . The plugin does not verify the security token on the request that cancels a subscription, resulting in a CSRF flaw. An attacker can craft a request that tricks a logged-in customer into cancelling...

CVE-2026-86784

The Visualizer WordPress plugin (versions before 4.0.8 ) contains a stored XSS vulnerability. The chart's JSON data source configuration is not sanitised or escaped before being output in the chart editor, allowing users with the Contributor role or above to inject JavaScript that executes in the...

CVE-2026-86823

The Newsletter WordPress plugin before 9.3.7 fails to validate the redirect destination performed after a public subscription action (via the ncu parameter). This allows unauthenticated attackers to redirect users to arbitrary external sites and disclose a subscriber token that grants access to t...

CVE-2026-86448

The LearnPress WordPress plugin (versions 4.3.2.8 through 4.4.6 ) fails to perform any authentication, capability, or nonce check before serving a previously generated order export file via the lp_download_order function. This allows unauthenticated attackers who can determine the file identifier...

CVE-2026-86447

The LearnPress WordPress plugin (before 4.4.7 , specifically version 4.4.6 ) contains a missing capability check in the load_content_via_ajax handler, an administrative course tool. This allows unauthenticated attackers to enumerate enrolled students' display names and user identifiers per course...