The Essential Real Estate WordPress plugin versions before 5.3.5 contain a vulnerability in an AJAX action that fails to verify whether a listing package selected for free activation is actually free or if the requesting user is authorized. This flaw allows self-registered customers to activate paid packages without payment, causing the site to record paid invoices incorrectly.
The All In One Login WordPress plugin versions before 2.5.0 have a vulnerability where the plugin does not properly limit the number of attempts against the short numeric code used in its default passwordless email login feature. Additionally, failed attempts are not counted towards the plugin's brute-force protection, enabling unauthenticated attackers to potentially take over any user account, including administrator accounts.
The FV Flowplayer Video Player WordPress plugin versions before 7.5.56.7212 contains a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows users with Contributor-level access or higher to supply a URL that the server fetches without proper validation. The response body of this fetch is stored and served publicly, enabling attackers to read internal resources if the response is returned with an image content type.
The Subscriptions for WooCommerce WordPress plugin versions before 2.1.1 have a vulnerability where membership content restrictions are only enforced on standard front-end page views. This allows unauthenticated users to access the full contents of restricted posts and pages through alternative routes that render the same content.
The Community Events WordPress plugin versions prior to 1.6.0 lack authorization and nonce checks in one of their AJAX actions. This vulnerability allows unauthenticated users to access details of event submissions that are awaiting moderation, which are not publicly visible on the site.
The FV Flowplayer Video Player WordPress plugin versions prior to 7.5.56.7212 contain a vulnerability where user-supplied input is not properly sanitized and escaped before being output on a page. This flaw allows users with Contributor role or higher to inject arbitrary scripts that execute when viewed by users with higher privileges.
The Tutor LMS WordPress plugin versions before 4.2.0 expose the correct answers to quiz questions in the page served to students during the quiz. This exposure occurs regardless of the plugin's settings intended to control answer visibility, allowing any enrolled student to see correct answers before submitting their attempt.
The FV Flowplayer Video Player WordPress plugin versions before 7.5.56.7212 lack authorization and CSRF checks on certain cloud storage media browser handlers. This flaw allows any authenticated user, even with minimal permissions like Subscriber, to access configuration details and file listings of the site's connected cloud storage accounts.
A vulnerability in the WP Event Manager WordPress plugin before version 3.4.2 allows unauthenticated attackers to read and overwrite arbitrary unpublished posts and pages, and convert them into events. This occurs because the plugin does not verify ownership or post type of user-supplied post identifiers in its front-end event submission flow.
The EWWW Image Optimizer WordPress plugin versions before 8.9.1 contain a vulnerability that allows authenticated users with author-level access or higher to inject arbitrary web scripts via post content. This occurs because the plugin does not properly sanitize and restrict certain values before dynamically loading and executing scripts on the page. The issue is a partial regression of CVE-2026-15446, as the origin and path restrictions introduced in versions 8.7.4 through 8.9.0 can be bypassed, leaving these versions vulnerable.
The WP Event Manager WordPress plugin versions prior to 3.4.2 contain a vulnerability where the plugin does not properly validate ownership or the type of user-supplied post identifiers in a frontend form. This flaw allows users with Subscriber accounts or higher to reassign authorship of arbitrary posts to themselves and force those posts to be published, potentially exposing private or draft content publicly. The vulnerability requires the relevant frontend feature to be enabled.
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers to make the site email its own vendors with the sender spoofed to an address at the site's own domain (such as its administrator), aligned with the domain's own SPF/DKIM.
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.
The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.
In Gogs version 0.14.3, a vulnerability exists in the Git Smart HTTP authorization layer where a push operation is allowed despite the user having only read access. This is due to inconsistent case-sensitive checks on the HTTP verb, leading to improper authorization. This issue is distinct from CVE-2026-52810.
The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.
iTerm2 versions before 3.7.7beta2 contain an argument injection vulnerability in the x-man-page URL handler. This flaw allows an attacker to execute arbitrary commands with the privileges of the logged-in user by tricking the user into opening a specially crafted URL. The vulnerability arises because percent-encoded NUL characters bypass input sanitization and are converted to whitespace during command-line parsing, enabling injection of additional arguments to the /usr/bin/man command, including the -P option to specify a malicious pager command. This issue is a regression due to an incomplete fix for CVE-2023-46321.