tag
Rest-Api
Critical
WordPress Mobile Builder Plugin JWT Authentication Bypass to Admin Account Creation (CVE-2025-68860)
CVE-2025-68860·
WordPress "Mobile Builder" plugin
unpatched
Critical
RestroPress WordPress Plugin Unauthenticated Information Exposure Leading to JWT Forgery / Account Takeover (CVE-2025-9209)
CVE-2025-9209·
RestroPress – Online Food Ordering System (WordPress plugin)
unpatched
Critical
KiotViet Sync Unauthenticated Arbitrary File Upload (CVE-2025-12674)
CVE-2025-12674·
KiotViet Sync (WordPress plugin)
unpatched
Critical
HPE OneView `id-pools/executeCommand` OS Command Injection (CVE-2025-37164)
CVE-2025-37164·
HPE OneView (infrastructure management appliance) REST API
unpatched
Critical
Fox LMS `createOrder` Unauthenticated Privilege Escalation to Administrator (CVE-2025-14156)
CVE-2025-14156·
Fox LMS (WordPress LMS plugin)
unpatched
Critical
AI Engine WordPress Plugin Unauthenticated MCP Token Disclosure to Admin Account Creation (CVE-2025-11749)
CVE-2025-11749·
AI Engine plugin for WordPress (mwai)
unpatched
Medium
WordPress "List Site Contributors" Plugin Reflected XSS Scanner (CVE-2026-0594)
CVE-2026-0594·
"List Site Contributors" WordPress plugin
unpatched
Critical
The Events Calendar WordPress Plugin Unauthenticated Blind SQL Injection (CVE-2026-49772)
CVE-2026-49772·
The Events Calendar (WordPress plugin, StellarWP / Liquid Web), experimental tec/v1 REST API
patched
Medium
Tandoor Recipes Authenticated Local File Disclosure via Recipe Import (CVE-2026-25964)
CVE-2026-25964 (GHSA-6485-jr28-52xx)·
Tandoor Recipes (self-hosted recipe manager, Django-based)
patched
Critical
Snow Monkey Forms — Unauthenticated Arbitrary File Deletion via Path Traversal (CVE-2026-1056)
CVE-2026-1056·
Snow Monkey Forms (WordPress plugin)
unpatched
High
Simple History Missing Authorization Account Takeover — CVE-2026-7459
CVE-2026-7459·
Simple History (WordPress plugin)
unpatched
High
Masteriyo LMS Authenticated Privilege Escalation to Administrator (CVE-2026-4484)
CVE-2026-4484·
Masteriyo LMS plugin for WordPress
unpatched
High
LatePoint Calendar Booking Plugin Agent-to-Administrator Privilege Escalation — CVE-2026-6741
CVE-2026-6741·
LatePoint – Calendar Booking Plugin for Appointments and Events (WordPress plugin, slug latepoint)
patched
Critical
Kirki WordPress Plugin Password-Reset Hijack Leading to Account Takeover (CVE-2026-8206)
CVE-2026-8206·
Kirki (WordPress Customizer framework plugin) — CompLibFormHandler REST API endpoint
unpatched
Critical
Hippoo Mobile App for WooCommerce — Unauthenticated Admin Account Takeover (CVE-2026-10580)
CVE-2026-10580·
Hippoo Mobile App for WooCommerce (WordPress plugin)
unpatched
Medium
ElementsKit Elementor Addons Authenticated Stored XSS via REST API (CVE-2026-2600)
CVE-2026-2600·
ElementsKit Elementor Addons (WordPress plugin)
patched