CVE-2026-84027Published
Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint
cve-program ·
Vendor product: Directorist: AI-Powered Business Directory, Listings & Classified Ads
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699054 source statements · aliases may refer to the same vulnerabilityCVE-2026-84046Published
Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL
cve-program ·
Vendor product: Directorist: AI-Powered Business Directory, Listings & Classified Ads
CVE-2026-84098Published
Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing
cve-program ·
Vendor product: Directorist: AI-Powered Business Directory, Listings & Classified Ads
CVE-2026-84150Published
Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint
cve-program ·
Vendor product: Directorist: AI-Powered Business Directory, Listings & Classified Ads
CVE-2026-84168Published
Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure
cve-program ·
Vendor product: Easy Hide Login
CVE-2026-84741Published
The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API
cve-program ·
Vendor product: The Events Calendar
CVE-2026-84742Published
The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API
cve-program ·
Vendor product: The Events Calendar
CVE-2026-84743Published
The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
cve-program ·
Vendor product: The Events Calendar
CVE-2026-85006Published
Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget
cve-program ·
Vendor product: HappyAddons for Elementor
CVE-2026-86602Published
WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview
cve-program ·
Vendor product: WP Recipe Maker
CVE-2026-86603Published
WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists
cve-program ·
Vendor product: WP Recipe Maker
CVE-2026-86608Published
WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion
cve-program ·
Vendor product: WP Recipe Maker
CVE-2026-86783Published
PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API
cve-program ·
Vendor product: Post Grid Gutenberg Blocks
CVE-2026-86842Published
Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite
cve-program ·
Vendor product: Real3D Flipbook
CVE-2026-87069Published
Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe
cve-program ·
Vendor product: Forminator Forms
CVE-2026-87074Published
Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link
cve-program ·
Vendor product: Forminator Forms
CVE-2026-87979Published
Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook
cve-program ·
Vendor product: Paymob for WooCommerce
CVE-2026-87981Published
Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX Actions
cve-program ·
Vendor product: Paymob for WooCommerce
CVE-2026-88929Published
Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure
cve-program ·
Vendor product: Product Badge, Label, Countdown Timer for WooCommerce
CVE-2026-88997Published
JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
cve-program ·
Vendor product: JSM Show Post Metadata
CVE-2026-89331Published
FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints
cve-program ·
Vendor product: FluentBoards
CVE-2026-90951Published
Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment
cve-program ·
Vendor product: Paid Membership Subscriptions
CVE-2026-90985Published
WPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc_load
cve-program ·
Vendor product: WPC Smart Compare for WooCommerce
CVE-2026-91024Published
Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)
cve-program ·
Vendor product: Booking Manager
CVE-2026-91025Published
Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR
cve-program ·
Vendor product: Booking Manager
CVE-2026-91073Published
Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting
cve-program ·
Vendor product: Subscribe Forms
CVE-2026-91077Published
Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list
cve-program ·
Vendor product: Event Booking Manager for WooCommerce
CVE-2026-93507Published
WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure
cve-program ·
Vendor product: WC Fields Factory
CVE-2026-93508Published
WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX
cve-program ·
Vendor product: WC Fields Factory
CVE-2026-93510Published
Points and Rewards for WooCommerce < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_points
cve-program ·
Vendor product: Points and Rewards for WooCommerce
CVE-2026-93511Published
Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass
cve-program ·
Vendor product: Premium Packages
CVE-2026-93528Published
NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page
cve-program ·
Vendor product: NP Quote Request for WooCommerce
CVE-2026-86601Published
WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content
cve-program ·
https://wordpress.org/plugins: WP Recipe Maker
CVE-2026-86604Published
GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation
cve-program ·
https://wordpress.org/plugins: GTranslate
CVE-2026-86612Published
Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source
cve-program ·
https://wordpress.org/plugins: Ninja Tables
CVE-2026-87070Published
Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing
cve-program ·
https://wordpress.org/plugins: Forminator Forms
CVE-2026-87071Published
Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts
cve-program ·
https://wordpress.org/plugins: Forminator Forms
CVE-2026-87848Published
MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure
cve-program ·
https://wordpress.org/plugins: MPCX Lightbox
CVE-2026-87978Published
Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction Callback
cve-program ·
https://wordpress.org/plugins: Paymob for WooCommerce
CVE-2026-90950Published
Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form
cve-program ·
https://wordpress.org/plugins: Paid Membership Subscriptions
GO-2026-5970Published
Infinite loop on invalid input in golang.org/x/text
osv · CVE-2026-56852
Go: golang.org/x/text
GO-2026-5017Published
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
osv · CVE-2026-39830 · GHSA-vgwf-h737-ff37
Go: golang.org/x/crypto
CVE-2026-13745Published
Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME
cve-program ·
Vendor product: Gemini CLI
MAL-2026-16470Published
Malicious code in z-deno-truth-bwhlsz (npm)
osv · GHSA-f8xr-gjfq-xfcp
npm: z-deno-truth-bwhlsz
CVE-2026-84217Published
WordPress Classified Listing plugin <= 6.1.3 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: classified-listing
CVE-2026-84835Published
WordPress Rentsyst plugin <= 2.1.5 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: rentsyst
CVE-2026-27422Published
WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: yt-player
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.