2026

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and custom

Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::action

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, aut

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate()

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name fi

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements end

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.

Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.

Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.

Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.

Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.

Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.

Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionali

Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.

Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generat

reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywavefor

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of iden

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site sig

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX action

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when s

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment st

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment st

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before retu

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before retu

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retriev

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store b

The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stor

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the ob

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using it

The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowi

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API list

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title befor

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthen

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the p

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints,

The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJ

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check whe

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a val

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's b

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's a

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON

A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the functio

A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.c