Skip to content
OpenAdvisories

Archive

2 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /2 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

169 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-8151

    Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF

    The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent mem…

    Web / CMS
  • Medium 4.8
    CVE-2026-81571

    Brave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter

    The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-si…

    Web / CMS
  • Medium 5.3
    CVE-2026-78153

    Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization

    The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerat…

    Web / CMS
  • Medium 5.3
    CVE-2026-77794

    RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity

    The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account ho…

    Web / CMS
  • Medium 5.3
    CVE-2026-77793

    RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field

    The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account.

    Web / CMS
  • Medium 6.5
    CVE-2026-2688

    CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass

    The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attacker…

    Web / CMS
  • Medium 5.3
    CVE-2026-17563

    WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form

    The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuratio…

    Web / CMS
  • Medium 6.6
    CVE-2026-10821

    Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

    The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is rea…

    Web / CMS
  • Medium 4.1
    CVE-2026-16647

    Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

    Drupal Disable Login Page drupal/disable_login Packagist
  • Medium 4.8
    CVE-2026-18986

    Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.

    Drupal Entity Browser drupal/entity_browser Packagist
  • Medium 5.3
    CVE-2026-73478

    Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096

    Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

    Drupal Diff drupal/diff Packagist
  • Medium 5.3
    CVE-2026-73474

    Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.

    Drupal Entity Share Websub drupal/entity_share_websub Packagist
  • Medium 5.4
    CVE-2026-73476

    External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098

    Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.

    Drupal External Authentication drupal/externalauth Packagist
  • Medium 5.3
    CVE-2026-73477

    Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099

    Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.

    Drupal Quick Tabs drupal/quicktabs Packagist
  • Medium 5.9
    CVE-2026-76757

    Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

    Drupal Gammu SMS Daemon
  • Medium 5.9
    CVE-2026-76756

    Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

    Drupal Gammu SMS Daemon
  • Medium 5.9
    CVE-2026-76755

    Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

    Drupal Gammu SMS Daemon drupal/gammu_smsd Packagist
  • Medium 5.9
    CVE-2026-76758

    Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101

    Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.

    Drupal Link content parser drupal/postlight_parser Packagist
  • Medium 4.8
    CVE-2026-81167

    Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.

    Drupal Address Suggestion drupal/address_suggestion Packagist
  • Medium 5.3
    CVE-2026-81165

    Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104

    Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.

    Drupal Blazy drupal/blazy Packagist
  • Medium 5.3
    CVE-2026-81269

    Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

    Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.

    Drupal Data field drupal/datafield Packagist
  • Medium 5.3
    CVE-2026-81166

    Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

    Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1.

    Drupal Digital Signage Framework drupal/digital_signage_framework Packagist
  • Medium 5.3
    CVE-2026-81162

    DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to …

    Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal drupal/dxpr_builder Web / CMS Packagist
  • Medium 5.3
    CVE-2026-81158

    Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113

    Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.

    Drupal Entity API drupal/entity Packagist
  • Medium 5.4
    CVE-2026-81164

    Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114

    Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.

    Drupal Entity PDF drupal/entity_pdf Packagist
  • Medium 5.3
    CVE-2026-81205

    LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.

    Drupal LDAP / Active Directory Integration drupal/ldap_auth Packagist
  • Medium 6.1
    CVE-2026-81201

    Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.

    Drupal Monster Menus drupal/monster_menus Packagist
  • Medium 6.1
    CVE-2026-81160

    Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0.

    Drupal Slick Carousel drupal/slick Packagist
  • Medium 5.4
    CVE-2026-84217

    WordPress Classified Listing plugin <= 6.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.3.

    Mamunur Rashid Classified Listing
  • Medium 5.3
    CVE-2026-84835

    WordPress Rentsyst plugin <= 2.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rentsyst: from n/a through 2.1.5.

    DimaFreund Rentsyst
  • Medium 5.4
    CVE-2026-66652

    WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.

    ThemeGoods Grand Tour
  • Medium 5.3
    CVE-2026-84780

    WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability

    Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.

    WPGMaps WP Go Maps
  • Medium 5.3
    CVE-2026-84775

    WordPress Really Simple SSL plugin <= 9.8.0 - Denial of Service Attack vulnerability

    Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.

    Really Simple Plugins Really Simple SSL
  • Medium 5.3
    CVE-2026-84771

    WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.

    publishpress PublishPress Permissions
  • Medium 5.5
    CVE-2026-84772

    WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability

    Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.

    WPMU DEV Broken Link Checker
  • Medium 5.3
    CVE-2026-84760

    WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.9 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.

    WP Swings Ultimate Gift Cards For WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-83562

    WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.

    WC Lovers WCFM Marketplace
  • Medium 6.5
    CVE-2026-82223

    WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.

    Arraytics WP Event Solution
  • Medium 6.5
    CVE-2026-84781

    WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.

    WP Chill Gallery PhotoBlocks
  • Medium 4.3
    CVE-2026-84808

    Kimai before 2.65.0 Authorization Bypass via API Timesheet

    Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restr…

    Kimai Project kimai