Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    9310 vulnerabilities by unknown

    CVE-2026-16955 (GCVE-0-2026-16955)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription
    Summary
    The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/1b413d84-61c7-4e… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown AI Engine Affected: 0 , < 3.6.6 (semver)
    		Create a notification for this product.
    Credits
    Revanth Hari Narayana Matte WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AI Engine",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.6.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Revanth Hari Narayana Matte"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AI Engine  WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:13.729Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/1b413d84-61c7-4e19-a693-312d74f618ff/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "AI Engine \u003c 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16955",
    "datePublished": "2026-08-08T06:00:13.729Z",
    "dateReserved": "2026-07-24T08:07:58.902Z",
    "dateUpdated": "2026-08-08T06:00:13.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16953 (GCVE-0-2026-16953)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie
    Summary
    The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/8f5460a7-9764-4c… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown AI Engine Affected: 0 , < 3.6.4 (semver)
    		Create a notification for this product.
    Credits
    Revanth Hari Narayana Matte WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AI Engine",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.6.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Revanth Hari Narayana Matte"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AI Engine  WordPress plugin before 3.6.4 does not verify ownership of a guest\u0027s uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim\u0027s session identifier and file reference can delete that victim\u0027s uploaded files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:13.553Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/8f5460a7-9764-4ce1-9cb4-8202b192765d/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "AI Engine \u003c 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16953",
    "datePublished": "2026-08-08T06:00:13.553Z",
    "dateReserved": "2026-07-24T08:07:54.768Z",
    "dateUpdated": "2026-08-08T06:00:13.553Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16948 (GCVE-0-2026-16948)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure
    Summary
    The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/50e47ee9-cffc-44… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Solace Extra Affected: 0 , < 1.6.1 (semver)
    		Create a notification for this product.
    Credits
    JunHee CHO WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Solace Extra",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "JunHee CHO"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:13.342Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/50e47ee9-cffc-4435-bc77-77fc65e9ff16/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Solace Extra \u003c 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16948",
    "datePublished": "2026-08-08T06:00:13.342Z",
    "dateReserved": "2026-07-24T08:02:03.522Z",
    "dateUpdated": "2026-08-08T06:00:13.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16608 (GCVE-0-2026-16608)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    Download Monitor < 5.2.6 - Unauthenticated Download Log Injection
    Summary
    The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/f9573555-bd5c-45… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Download Monitor Affected: 0 , < 5.2.6 (semver)
    		Create a notification for this product.
    Credits
    Anirudh Gupta WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Download Monitor",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "5.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Anirudh Gupta"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site\u0027s download statistics."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:12.854Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/f9573555-bd5c-451c-85dd-d964379d12d1/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Download Monitor \u003c 5.2.6 - Unauthenticated Download Log Injection",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16608",
    "datePublished": "2026-08-08T06:00:12.854Z",
    "dateReserved": "2026-07-22T14:31:56.823Z",
    "dateUpdated": "2026-08-08T06:00:12.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16595 (GCVE-0-2026-16595)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure
    Summary
    The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/e960f5b2-18e9-43… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Directory Kit Affected: 0 , < 1.5.5 (semver)
    		Create a notification for this product.
    Credits
    Yaswanth Reddy Sunkara WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Directory Kit",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yaswanth Reddy Sunkara"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site\u0027s user list and unpublished listings belonging to other users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:12.661Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e960f5b2-18e9-436b-8828-6a105c7f9dd5/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP Directory Kit \u003c 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16595",
    "datePublished": "2026-08-08T06:00:12.661Z",
    "dateReserved": "2026-07-22T13:47:43.066Z",
    "dateUpdated": "2026-08-08T06:00:12.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16594 (GCVE-0-2026-16594)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure
    Summary
    The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/d055d385-7e8a-41… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Directory Kit Affected: 0 , < 1.5.5 (semver)
    		Create a notification for this product.
    Credits
    Yaswanth Reddy Sunkara WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Directory Kit",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yaswanth Reddy Sunkara"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:12.492Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/d055d385-7e8a-4179-aa21-f07e240fd181/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP Directory Kit \u003c 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16594",
    "datePublished": "2026-08-08T06:00:12.492Z",
    "dateReserved": "2026-07-22T13:47:41.225Z",
    "dateUpdated": "2026-08-08T06:00:12.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16590 (GCVE-0-2026-16590)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure
    Summary
    The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/ddf13b08-4ee2-46… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Directory Kit Affected: 0 , < 1.5.5 (semver)
    		Create a notification for this product.
    Credits
    Yaswanth Reddy Sunkara WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Directory Kit",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yaswanth Reddy Sunkara"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:12.320Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/ddf13b08-4ee2-46a1-929c-1f435e9e49d4/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP Directory Kit \u003c 1.5.5 - Subscriber+ Contact Message and User Data Disclosure",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16590",
    "datePublished": "2026-08-08T06:00:12.320Z",
    "dateReserved": "2026-07-22T13:47:32.725Z",
    "dateUpdated": "2026-08-08T06:00:12.320Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16589 (GCVE-0-2026-16589)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter
    Summary
    The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/6ee8c3b7-5ffe-4b… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Directory Kit Affected: 0 , < 1.5.5 (semver)
    		Create a notification for this product.
    Credits
    Yaswanth Reddy Sunkara WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Directory Kit",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yaswanth Reddy Sunkara"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:12.142Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/6ee8c3b7-5ffe-4b9e-877a-ea3e1924e8d3/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP Directory Kit \u003c 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16589",
    "datePublished": "2026-08-08T06:00:12.142Z",
    "dateReserved": "2026-07-22T13:47:30.930Z",
    "dateUpdated": "2026-08-08T06:00:12.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16578 (GCVE-0-2026-16578)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route
    Summary
    The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/c02393ee-1ade-43… exploitvdb-entrytechnical-description
    Impacted products
    Credits
    lodos2005 WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Admin Safety Guard \u2014 Login Security, Limit Logins, 2FA \u0026 Brute Force Protection",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.4.0",
              "status": "affected",
              "version": "1.2.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "lodos2005"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Admin Safety Guard \u2014 Login Security, Limit Logins, 2FA \u0026 Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:11.971Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/c02393ee-1ade-433e-bbd0-c09785e5c426/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Admin Safety Guard \u003c 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16578",
    "datePublished": "2026-08-08T06:00:11.971Z",
    "dateReserved": "2026-07-22T13:28:30.713Z",
    "dateUpdated": "2026-08-08T06:00:11.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16574 (GCVE-0-2026-16574)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint
    Summary
    The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/b38dc6a4-a590-40… exploitvdb-entrytechnical-description
    Impacted products
    Credits
    Sai Praneeth Koti WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "5.0.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sai Praneeth Koti"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor\u0027s paid downloadable files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:11.760Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/b38dc6a4-a590-402f-88e1-3624a22c7348/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Dokan \u003c 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16574",
    "datePublished": "2026-08-08T06:00:11.760Z",
    "dateReserved": "2026-07-22T13:01:02.571Z",
    "dateUpdated": "2026-08-08T06:00:11.760Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16562 (GCVE-0-2026-16562)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    WP Statistics < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers
    Summary
    The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/09d79a3f-7bf0-47… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Statistics Affected: 0 , < 14.16.10 (semver)
    		Create a notification for this product.
    Credits
    Shivamani Vastrala WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Statistics",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "14.16.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shivamani Vastrala"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Statistics  WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site\u0027s visitor analytics data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:11.585Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/09d79a3f-7bf0-47ab-bf6d-913eaeb71630/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP Statistics \u003c 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16562",
    "datePublished": "2026-08-08T06:00:11.585Z",
    "dateReserved": "2026-07-22T12:27:00.681Z",
    "dateUpdated": "2026-08-08T06:00:11.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16559 (GCVE-0-2026-16559)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload
    Summary
    The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/9b8d265a-542f-4e… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown YMC Filter Affected: 0 , < 3.12.9 (semver)
    		Create a notification for this product.
    Credits
    Artus KG WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "YMC Filter",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.12.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Artus KG"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site\u0027s origin when the file is viewed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:11.413Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/9b8d265a-542f-4e1b-966d-3fc3dbf7a800/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "YMC Filter \u003c 3.12.9 - Author+ Stored XSS via SVG Icon Upload",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16559",
    "datePublished": "2026-08-08T06:00:11.413Z",
    "dateReserved": "2026-07-22T12:09:50.019Z",
    "dateUpdated": "2026-08-08T06:00:11.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16558 (GCVE-0-2026-16558)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema
    Summary
    The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/06ba0551-deab-41… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown YMC Filter Affected: 3.6.0 , < 3.12.8 (semver)
    		Create a notification for this product.
    Credits
    Usama Arshad WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "YMC Filter",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.12.8",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Usama Arshad"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:11.244Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/06ba0551-deab-41fb-b501-eef0727b431a/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "YMC Filter \u003c 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16558",
    "datePublished": "2026-08-08T06:00:11.244Z",
    "dateReserved": "2026-07-22T12:09:48.181Z",
    "dateUpdated": "2026-08-08T06:00:11.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16535 (GCVE-0-2026-16535)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel
    Summary
    The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/3b6c0efb-c503-43… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Link Library Affected: 0 , < 7.9.4 (semver)
    		Create a notification for this product.
    Credits
    João Ramos Maciel WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Link Library",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "7.9.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jo\u00e3o Ramos Maciel"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:11.068Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/3b6c0efb-c503-437a-8f9b-f8a8c032313c/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Link Library \u003c 7.9.4 - Reflected XSS via Thumbs-Rating likelabel",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16535",
    "datePublished": "2026-08-08T06:00:11.068Z",
    "dateReserved": "2026-07-22T09:21:40.853Z",
    "dateUpdated": "2026-08-08T06:00:11.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16282 (GCVE-0-2026-16282)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter
    Summary
    The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/e87116af-d202-43… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Appointment Hour Booking Affected: 0 , < 1.5.88 (semver)
    		Create a notification for this product.
    Credits
    Researcher1: Alessandro Greco aka Aleff; Researcher2: Giovambattista Ianni; Company/Organization: University of Calabria (UNICAL) WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Hour Booking",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.5.88",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Researcher1: Alessandro Greco aka Aleff; Researcher2: Giovambattista Ianni; Company/Organization: University of Calabria (UNICAL)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Hour Booking  WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:10.896Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e87116af-d202-434b-9f47-e61e9c886240/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Appointment Hour Booking \u003c 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16282",
    "datePublished": "2026-08-08T06:00:10.896Z",
    "dateReserved": "2026-07-20T10:58:19.374Z",
    "dateUpdated": "2026-08-08T06:00:10.896Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16269 (GCVE-0-2026-16269)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling
    Summary
    The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/8b09afba-16a5-4d… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Newsletters Affected: 0 , < 4.16 (semver)
    		Create a notification for this product.
    Credits
    Haitam Lazaar WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Newsletters",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Haitam Lazaar"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:10.712Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/8b09afba-16a5-4d6c-9e85-84433a3c0d66/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Newsletters \u003c 4.16 - Unauthenticated API Authentication Bypass via Type Juggling",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16269",
    "datePublished": "2026-08-08T06:00:10.712Z",
    "dateReserved": "2026-07-20T09:09:41.544Z",
    "dateUpdated": "2026-08-08T06:00:10.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16267 (GCVE-0-2026-16267)

    Vulnerability from nvd – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field
    Summary
    The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/b51c11d6-5bfa-4b… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Newsletters Affected: 0 , < 4.16 (semver)
    		Create a notification for this product.
    Credits
    Sai Praneeth Koti WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Newsletters",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sai Praneeth Koti"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:10.538Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/b51c11d6-5bfa-4b2c-b348-cda19889deee/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Newsletters \u003c 4.16 - Unauthenticated PHP Object Injection via Date Form Field",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16267",
    "datePublished": "2026-08-08T06:00:10.538Z",
    "dateReserved": "2026-07-20T09:09:37.520Z",
    "dateUpdated": "2026-08-08T06:00:10.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16955 (GCVE-0-2026-16955)

    Vulnerability from cvelistv5 – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription
    Summary
    The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/1b413d84-61c7-4e… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown AI Engine Affected: 0 , < 3.6.6 (semver)
    		Create a notification for this product.
    Credits
    Revanth Hari Narayana Matte WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AI Engine",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.6.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Revanth Hari Narayana Matte"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AI Engine  WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:13.729Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/1b413d84-61c7-4e19-a693-312d74f618ff/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "AI Engine \u003c 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16955",
    "datePublished": "2026-08-08T06:00:13.729Z",
    "dateReserved": "2026-07-24T08:07:58.902Z",
    "dateUpdated": "2026-08-08T06:00:13.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16953 (GCVE-0-2026-16953)

    Vulnerability from cvelistv5 – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie
    Summary
    The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/8f5460a7-9764-4c… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown AI Engine Affected: 0 , < 3.6.4 (semver)
    		Create a notification for this product.
    Credits
    Revanth Hari Narayana Matte WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AI Engine",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.6.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Revanth Hari Narayana Matte"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AI Engine  WordPress plugin before 3.6.4 does not verify ownership of a guest\u0027s uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim\u0027s session identifier and file reference can delete that victim\u0027s uploaded files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:13.553Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/8f5460a7-9764-4ce1-9cb4-8202b192765d/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "AI Engine \u003c 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16953",
    "datePublished": "2026-08-08T06:00:13.553Z",
    "dateReserved": "2026-07-24T08:07:54.768Z",
    "dateUpdated": "2026-08-08T06:00:13.553Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16948 (GCVE-0-2026-16948)

    Vulnerability from cvelistv5 – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure
    Summary
    The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/50e47ee9-cffc-44… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Solace Extra Affected: 0 , < 1.6.1 (semver)
    		Create a notification for this product.
    Credits
    JunHee CHO WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Solace Extra",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "JunHee CHO"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:13.342Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/50e47ee9-cffc-4435-bc77-77fc65e9ff16/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Solace Extra \u003c 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16948",
    "datePublished": "2026-08-08T06:00:13.342Z",
    "dateReserved": "2026-07-24T08:02:03.522Z",
    "dateUpdated": "2026-08-08T06:00:13.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16608 (GCVE-0-2026-16608)

    Vulnerability from cvelistv5 – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    Download Monitor < 5.2.6 - Unauthenticated Download Log Injection
    Summary
    The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/f9573555-bd5c-45… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Download Monitor Affected: 0 , < 5.2.6 (semver)
    		Create a notification for this product.
    Credits
    Anirudh Gupta WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Download Monitor",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "5.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Anirudh Gupta"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site\u0027s download statistics."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:12.854Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/f9573555-bd5c-451c-85dd-d964379d12d1/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Download Monitor \u003c 5.2.6 - Unauthenticated Download Log Injection",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16608",
    "datePublished": "2026-08-08T06:00:12.854Z",
    "dateReserved": "2026-07-22T14:31:56.823Z",
    "dateUpdated": "2026-08-08T06:00:12.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16595 (GCVE-0-2026-16595)

    Vulnerability from cvelistv5 – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure
    Summary
    The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/e960f5b2-18e9-43… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Directory Kit Affected: 0 , < 1.5.5 (semver)
    		Create a notification for this product.
    Credits
    Yaswanth Reddy Sunkara WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Directory Kit",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yaswanth Reddy Sunkara"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site\u0027s user list and unpublished listings belonging to other users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:12.661Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e960f5b2-18e9-436b-8828-6a105c7f9dd5/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP Directory Kit \u003c 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16595",
    "datePublished": "2026-08-08T06:00:12.661Z",
    "dateReserved": "2026-07-22T13:47:43.066Z",
    "dateUpdated": "2026-08-08T06:00:12.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16594 (GCVE-0-2026-16594)

    Vulnerability from cvelistv5 – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure
    Summary
    The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/d055d385-7e8a-41… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Directory Kit Affected: 0 , < 1.5.5 (semver)
    		Create a notification for this product.
    Credits
    Yaswanth Reddy Sunkara WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Directory Kit",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yaswanth Reddy Sunkara"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:12.492Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/d055d385-7e8a-4179-aa21-f07e240fd181/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP Directory Kit \u003c 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16594",
    "datePublished": "2026-08-08T06:00:12.492Z",
    "dateReserved": "2026-07-22T13:47:41.225Z",
    "dateUpdated": "2026-08-08T06:00:12.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16590 (GCVE-0-2026-16590)

    Vulnerability from cvelistv5 – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure
    Summary
    The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/ddf13b08-4ee2-46… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Directory Kit Affected: 0 , < 1.5.5 (semver)
    		Create a notification for this product.
    Credits
    Yaswanth Reddy Sunkara WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Directory Kit",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yaswanth Reddy Sunkara"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:12.320Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/ddf13b08-4ee2-46a1-929c-1f435e9e49d4/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP Directory Kit \u003c 1.5.5 - Subscriber+ Contact Message and User Data Disclosure",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16590",
    "datePublished": "2026-08-08T06:00:12.320Z",
    "dateReserved": "2026-07-22T13:47:32.725Z",
    "dateUpdated": "2026-08-08T06:00:12.320Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16589 (GCVE-0-2026-16589)

    Vulnerability from cvelistv5 – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter
    Summary
    The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/6ee8c3b7-5ffe-4b… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Directory Kit Affected: 0 , < 1.5.5 (semver)
    		Create a notification for this product.
    Credits
    Yaswanth Reddy Sunkara WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Directory Kit",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yaswanth Reddy Sunkara"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:12.142Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/6ee8c3b7-5ffe-4b9e-877a-ea3e1924e8d3/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP Directory Kit \u003c 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16589",
    "datePublished": "2026-08-08T06:00:12.142Z",
    "dateReserved": "2026-07-22T13:47:30.930Z",
    "dateUpdated": "2026-08-08T06:00:12.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16578 (GCVE-0-2026-16578)

    Vulnerability from cvelistv5 – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route
    Summary
    The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/c02393ee-1ade-43… exploitvdb-entrytechnical-description
    Impacted products
    Credits
    lodos2005 WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Admin Safety Guard \u2014 Login Security, Limit Logins, 2FA \u0026 Brute Force Protection",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.4.0",
              "status": "affected",
              "version": "1.2.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "lodos2005"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Admin Safety Guard \u2014 Login Security, Limit Logins, 2FA \u0026 Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:11.971Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/c02393ee-1ade-433e-bbd0-c09785e5c426/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Admin Safety Guard \u003c 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16578",
    "datePublished": "2026-08-08T06:00:11.971Z",
    "dateReserved": "2026-07-22T13:28:30.713Z",
    "dateUpdated": "2026-08-08T06:00:11.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16574 (GCVE-0-2026-16574)

    Vulnerability from cvelistv5 – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint
    Summary
    The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/b38dc6a4-a590-40… exploitvdb-entrytechnical-description
    Impacted products
    Credits
    Sai Praneeth Koti WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "5.0.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sai Praneeth Koti"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor\u0027s paid downloadable files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:11.760Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/b38dc6a4-a590-402f-88e1-3624a22c7348/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Dokan \u003c 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16574",
    "datePublished": "2026-08-08T06:00:11.760Z",
    "dateReserved": "2026-07-22T13:01:02.571Z",
    "dateUpdated": "2026-08-08T06:00:11.760Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16562 (GCVE-0-2026-16562)

    Vulnerability from cvelistv5 – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    WP Statistics < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers
    Summary
    The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/09d79a3f-7bf0-47… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown WP Statistics Affected: 0 , < 14.16.10 (semver)
    		Create a notification for this product.
    Credits
    Shivamani Vastrala WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Statistics",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "14.16.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shivamani Vastrala"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Statistics  WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site\u0027s visitor analytics data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:11.585Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/09d79a3f-7bf0-47ab-bf6d-913eaeb71630/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP Statistics \u003c 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16562",
    "datePublished": "2026-08-08T06:00:11.585Z",
    "dateReserved": "2026-07-22T12:27:00.681Z",
    "dateUpdated": "2026-08-08T06:00:11.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16559 (GCVE-0-2026-16559)

    Vulnerability from cvelistv5 – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload
    Summary
    The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/9b8d265a-542f-4e… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown YMC Filter Affected: 0 , < 3.12.9 (semver)
    		Create a notification for this product.
    Credits
    Artus KG WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "YMC Filter",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.12.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Artus KG"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site\u0027s origin when the file is viewed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:11.413Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/9b8d265a-542f-4e1b-966d-3fc3dbf7a800/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "YMC Filter \u003c 3.12.9 - Author+ Stored XSS via SVG Icon Upload",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16559",
    "datePublished": "2026-08-08T06:00:11.413Z",
    "dateReserved": "2026-07-22T12:09:50.019Z",
    "dateUpdated": "2026-08-08T06:00:11.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16558 (GCVE-0-2026-16558)

    Vulnerability from cvelistv5 – Published: 2026-08-08 06:00 – Updated: 2026-08-08 06:00
    VLAI
    Title
    YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema
    Summary
    The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/06ba0551-deab-41… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown YMC Filter Affected: 3.6.0 , < 3.12.8 (semver)
    		Create a notification for this product.
    Credits
    Usama Arshad WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "YMC Filter",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.12.8",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Usama Arshad"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T06:00:11.244Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/06ba0551-deab-41fb-b501-eef0727b431a/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "YMC Filter \u003c 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16558",
    "datePublished": "2026-08-08T06:00:11.244Z",
    "dateReserved": "2026-07-22T12:09:48.181Z",
    "dateUpdated": "2026-08-08T06:00:11.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}