WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.

WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.

WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.

Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site's sender name and email address via forged requests from an admin's browser. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') and adding explicit administrative authorization verification via AccessControl::create()->canAdmin().

GoCD is vulnerable to authorization bypass via pipeline structure API

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an administrator role. A lower-privileged user can enumerate configured user names and available role names, which can facilitate attacks against those users. The response does not reveal which roles are assigned to each user, and the endpoint cannot modify data. This issue is fixed in version 26.1.0.

WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability

Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.

WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.

WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.

WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

Insecure Access Controls Permit Local Non-Administrative Users to Command Fabric OS Switches

Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches under the security context of the SANnav management user.

WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.

WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.

WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.

WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-56120. Reason: This candidate is a duplicate of CVE-2026-56120. Notes: All CVE users should reference CVE-2026-56120 instead of this candidate.

Klever-Go: /log controls global node logging

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.