BackUpWordPress plugin versions before 3.15 contain a vulnerability where an AJAX action that cleans up the backup directory lacks proper capability or nonce checks. This flaw allows any authenticated user with Subscriber or higher privileges to delete backup protection and working files, potentially disrupting backups and removing download protection from stored backups.
The Turisbook Booking System WordPress plugin up to version 1.3.8 contains a vulnerability that allows unauthenticated users to perform stored Cross-Site Scripting (XSS) attacks against administrators. This occurs because the plugin lacks authorization and CSRF checks when saving settings and fails to properly sanitize and escape one of the settings before outputting it on an admin page.
Contact Form 7 versions before 6.2.4 allow unauthenticated users to upload arbitrary files without validating file type or extension. A flaw in temporary-file cleanup leaves these files on disk. On certain Apache configurations (Debian/Ubuntu with directory listing and .phar mapped to PHP), this can lead to remote code execution. On other configurations, the impact is limited to arbitrary file upload that may be served as active content from the uploads directory.
The Pie Register WordPress plugin versions up to 3.8.4.15 contains a missing authorization check in one of its AJAX actions. This flaw allows users with a contributor role to modify invitation-code records created by administrators.
CVE-2026-96961 is a vulnerability in the Pie Register WordPress plugin up to version 3.8.4.15. It lacks proper authorization checks on a request handler, allowing unauthenticated attackers to reset plugin settings to defaults and delete a plugin data table. This can disable registration security controls such as new-user email verification.
The Antom Payments WordPress plugin versions up to 2.0.11 do not verify ownership or authorization before disclosing an order's confirmation link containing a secret key to unauthenticated users. This vulnerability allows attackers to access any customer's order details, including personal information such as name, address, phone number, and email.
A Cross-site Scripting (XSS) vulnerability exists in the Secure Custom Fields WordPress plugin before version 6.9.8. The flaw arises because the plugin does not sanitize a persisted field definition before using it as an HTML attribute name. This allows a user with the ability to configure fields to inject JavaScript payloads that execute in the browsers of users viewing the affected fields. In multisite environments, site administrators without the unfiltered_html capability can exploit this to inject scripts into other users' sessions.
A vulnerability in the Secure Custom Fields WordPress plugin before version 6.9.8 allows users with post-editing permissions (Contributor and above) to access titles and non-public statuses of unpublished posts belonging to other users. This occurs because the plugin does not perform proper read-permission checks when rendering relational field values.
The Secure Custom Fields WordPress plugin before version 6.9.8 contains an authorization bypass vulnerability. This flaw allows users with contributor-level access or higher to modify bidirectional relationship references on posts, users, or terms they are not authorized to edit. The issue arises because the plugin does not verify user permissions before synchronizing these relationships.
A vulnerability in the Secure Custom Fields WordPress plugin before version 6.9.8 allows users with contributor-level access and above to bypass field-group location restrictions and write custom fields intended only for administrators onto their own posts.
The FV Flowplayer Video Player WordPress plugin before version 7.5.57.7212 contains a missing authorization vulnerability in an AJAX action that performs a site-wide content rewrite. This flaw allows any authenticated user, including those with subscriber-level permissions, to trigger bulk modifications of posts they should not have permission to edit.
The Event Tickets Manager for WooCommerce WordPress plugin versions before 1.6.0 contains an authorization bypass vulnerability in its ticket-transfer feature. This flaw allows unauthenticated users to transfer guest-checkout tickets belonging to other attendees to an email address of their choice. As a result, the legitimate ticket is invalidated and the ticket PDF, which includes personal attendee data, is sent to the attacker.
A vulnerability in the Pronamic Pay WordPress plugin and the Pronamic Pay doneren met Mollie WordPress plugin allows unauthenticated users to access stored form submissions via the REST API. This exposure affects versions prior to 11.1.0 for Pronamic Pay and prior to 1.7.1 for the doneren met Mollie plugin. The issue permits unauthorized reading of messages submitted by visitors through bundled forms.
The WP Recipe Maker WordPress plugin versions before 10.9.2 do not verify if a post containing a recipe is password protected before exposing the recipe content via its REST API and structured data output. This flaw allows unauthenticated users to access full recipe content from posts that are intended to be password protected.
SunEditor versions from 3.0.0 up to but not including 3.4.0 contain a stored cross-site scripting (XSS) vulnerability in the html.clean() function. This function rebuilds iframes from JSON data without properly filtering certain attributes like srcdoc or uppercase SRC keys. An attacker can exploit this by injecting crafted HTML via paste, html.set, or html.insert methods, leading to script execution in the context of the host page when the content is loaded or pasted.
UnrealIRCd versions 6.0.0 up to but not including 6.2.7.1 contain a vulnerability in the labeled-response module where the IRCv3 "label" message tag is not properly escaped. This flaw allows any user on a network with two or more linked servers to inject server-to-server commands that execute with server authority.
A vulnerability in imgproxy versions from 3.3.0 up to but not including 4.0.16 allows attackers to cause unbounded memory allocation via a crafted ICO file. The flaw arises because the ICO loader does not validate the data_size field, enabling memory exhaustion and worker crashes without requiring authentication.
Rustls versions from 0.23.13 up to but not including 0.23.45 improperly accept TLS 1.3 handshake messages at incorrect encryption levels when these messages follow a key-changing message within the same record. This occurs because the Deframer::aligned function does not enforce the record-boundary alignment required by RFC 8446. An attacker, either a peer or someone on the communication path, can exploit this by packing a plaintext EncryptedExtensions message with the ServerHello, which rustls then accepts as unencrypted.
imgproxy versions from 4.0.0 up to but not including 4.0.16 contain an integer overflow vulnerability in the ICO image loader. This flaw allows remote attackers to craft ICO images with a manipulated data_size value that triggers a heap buffer overflow. Exploitation can lead to process crashes or potentially remote code execution.
A vulnerability exists in Hickory DNS hickory-proto versions 0.25.0-alpha.3 through 0.25.2 and hickory-net versions before 0.26.1 involving an unbounded loop in the DnssecDnsHandle NSEC3 closest-encloser proof validation. This occurs when the SOA owner is not an ancestor of the QNAME, allowing upstream attackers to send NoData or NXDomain responses with a cross-zone SOA record that can cause panic in debug builds or memory exhaustion in release builds.