CVE Notifier

CVE-2026-92430 CWE-? N/A

Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated att…

cve.org Unknown:Rede · Itaú · for 10 jam lalu

CVE-2026-92425 CWE-? N/A

Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own…

cve.org Unknown:Hydra · Booking · — 10 jam lalu

CVE-2026-92421 CWE-? N/A

Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding…

cve.org Unknown:Hydra · Booking · — 10 jam lalu

CVE-2026-92420 CWE-? N/A

Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, a…

cve.org Unknown:Hydra · Booking · — 10 jam lalu

CVE-2026-92404 CWE-? N/A

MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write …

cve.org Unknown:MgoSync 10 jam lalu

CVE-2026-92403 CWE-? N/A

Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against …

cve.org Unknown:Secure · Custom · Fields 10 jam lalu

CVE-2026-92099 CWE-? N/A

WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to pub…

cve.org Unknown:WPGraphQL · Smart · Cache 10 jam lalu

CVE-2026-91847 CWE-? N/A

Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing…

cve.org Unknown:Online · Scheduling · and 10 jam lalu

CVE-2026-88926 CWE-? N/A

VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL inje…

cve.org Unknown:VikRentItems · Flexible · Rental 10 jam lalu

CVE-2026-88824 CWE-? N/A

Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area,…

cve.org Unknown:Master · Blocks 10 jam lalu

CVE-2026-86814 CWE-? N/A

UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to l…

cve.org Unknown:UsersWP 10 jam lalu

CVE-2026-86591 CWE-? N/A

Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could le…

cve.org Unknown:Botiga · Pro 10 jam lalu