tag
Password-Reset
Critical
WordPress Simple Link Directory Unauthenticated Password Reset to Admin Takeover (CVE-2025-49901)
CVE-2025-49901·
WordPress "Simple Link Directory" plugin (qc-simple-link-directory by quantumcloud)
patched
Critical
SmarterMail Auth Bypass via Password Reset to Pre-Auth RCE (CVE-2025-52691 / WT-2026-0001)
CVE-2025-52691·
SmarterMail (SmarterTools webmail/mail server)
patched
Critical
Simple Business Directory Pro Unauthenticated Password Reset to Admin Takeover (CVE-2025-53580)
CVE-2025-53580·
quantumcloud "Simple Business Directory Pro" WordPress plugin (simple-business-directory-pro)
patched
Critical
WordPress SignUp/SignIn & Invoice Generator Password-Reset Account Takeover (CVE-2026-12416 / CVE-2026-12417)
CVE-2026-12416, CVE-2026-12417·
SignUp & SignIn WordPress plugin (CVE-2026-12417); Invoice Generator WordPress plugin (CVE-2026-12416)
unpatched
Critical
Strapi CMS Admin Account Takeover via Query Filter Bypass — CVE-2026-27886
CVE-2026-27886·
Strapi CMS (Content API)
unpatched
Critical
SmarterMail Unauthenticated Admin Password Reset (CVE-2026-0001 / WT-2026-0001)
CVE-2026-0001 (tracked publicly as WT-2026-0001)·
SmarterTools SmarterMail (webmail/admin control panel), typically on port 9998
patched
Critical
SmarterMail Admin Password-Reset Authentication Bypass (CVE-2026-23760)
CVE-2026-23760·
SmarterTools SmarterMail
patched
High
Simple History Missing Authorization Account Takeover — CVE-2026-7459
CVE-2026-7459·
Simple History (WordPress plugin)
unpatched
Moderate
FOSSBilling Unauthenticated API Key Config Disclosure & Password Reset Token Reuse — CVE-2026-53647
CVE-2026-53647 (also documents chained CVE-2026-53646)·
FOSSBilling (open-source billing/client management platform)
patched
Critical
ARMember WordPress Plugin Insecure Password Reset via Plaintext Key + SQLi Chain (CVE-2026-5076)
CVE-2026-5076 (chained with CVE-2026-5073, CVE-2026-5074)·
ARMember – Membership Plugin & Content Restriction (WordPress plugin)
patched