Base de CVEs

CVE-2026-34722 Média · 4.3 CWE-862 08/04/2026

Zammad is missing authorization in ticket create endpoint

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4.

CVE-2026-0814 Média · 4.3 CWE-862 08/04/2026

Advanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_excel' function in all versions up to, and including, 2.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export form submissions to excel file.

CVE-2026-33229 Crítica · 9.8 CWE-862 08/04/2026

XWiki Platform: execução remota de código via API de scripting Velocity sem proteção adequada

XWiki Platform é uma plataforma genérica de wiki que oferece serviços de execução para aplicações construídas sobre ela. Antes das versões 17.4.8 e 17.10.1, uma API de scripting mal protegida permite que qualquer usuário com o direito de script contorne o sandbox da API de scripting Velocity e execute, por exemplo, scripts Python arbitrários, obtendo acesso total à instância XWiki e comprometendo a confidencialidade, a integridade e a disponibilidade de toda a instância. Observe que o direito de script já constitui um nível elevado de acesso, que não recomendamos conceder a usuários não confiáveis. Esta vulnerabilidade é corrigida nas versões 17.4.8 e 17.10.1.

CVE-2026-39716 Média · 5.3 CWE-862 08/04/2026

WordPress Flipmart theme <= 2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in CKThemes Flipmart flipmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flipmart: from n/a through <= 2.8.

CVE-2026-39715 Média · 5.3 CWE-862 08/04/2026

WordPress AnyTrack Affiliate Link Manager plugin <= 1.5.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyTrack Affiliate Link Manager: from n/a through <= 1.5.5.

CVE-2026-39714 Média · 5.3 CWE-862 08/04/2026

WordPress G5Plus April theme <= 6.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in G5Theme G5Plus April g5plus-april allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects G5Plus April: from n/a through <= 6.8.

CVE-2026-39713 Média · 5.3 CWE-862 08/04/2026

WordPress Mailercloud – Integrate webforms and synchronize website contacts plugin <= 1.0.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in mailercloud Mailercloud – Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize-contacts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mailercloud – Integrate webforms and synchronize website contacts: from n/a through <= 1.0.7.

CVE-2026-39707 Média · 5.3 CWE-862 08/04/2026

WordPress Accept PayPal Payments using Contact Form 7 plugin <= 4.0.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept PayPal Payments using Contact Form 7: from n/a through <= 4.0.4.

CVE-2026-39706 Média · 5.3 CWE-862 08/04/2026

WordPress Make My Trivia plugin <= 1.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Netro Systems Make My Trivia trivialy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Make My Trivia: from n/a through <= 1.1.0.

CVE-2026-39705 Média · 5.3 CWE-862 08/04/2026

WordPress MIPL WC Multisite Sync plugin <= 1.4.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mulika Team MIPL WC Multisite Sync mipl-wc-multisite-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MIPL WC Multisite Sync: from n/a through <= 1.4.4.

CVE-2026-39704 Média · 5.3 CWE-862 08/04/2026

WordPress Precious Metals Automated Product Pricing – Pro plugin <= 4.0.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing – Pro: from n/a through <= 4.0.5.

CVE-2026-39701 Média · 5.3 CWE-862 08/04/2026

WordPress ShopWP plugin <= 5.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Andrew ShopWP wpshopify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopWP: from n/a through <= 5.2.4.

CVE-2026-39700 Média · 5.3 CWE-862 08/04/2026

WordPress WowOptin plugin <= 1.4.32 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPXPO WowOptin optin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowOptin: from n/a through <= 1.4.32.

CVE-2026-39699 Média · 5.3 CWE-862 08/04/2026

WordPress AI Workflow Automation plugin <= 1.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in massiveshift AI Workflow Automation ai-workflow-automation-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Workflow Automation: from n/a through <= 1.4.2.

CVE-2026-39698 Média · 5.3 CWE-862 08/04/2026

WordPress The Publisher Desk ads.txt plugin <= 1.5.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in PublisherDesk The Publisher Desk ads.txt the-publisher-desk-ads-txt allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Publisher Desk ads.txt: from n/a through <= 1.5.0.

CVE-2026-39697 Média · 5.3 CWE-862 08/04/2026

WordPress MAIO – The new AI GEO / SEO tool plugin <= 6.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in HBSS Technologies MAIO – The new AI GEO / SEO tool maio-the-new-ai-geo-seo-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MAIO – The new AI GEO / SEO tool: from n/a through <= 6.2.8.

CVE-2026-39694 Média · 5.3 CWE-862 08/04/2026

WordPress Simply Schedule Appointments plugin <= 1.6.10.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.10.2.

CVE-2026-39691 Média · 5.3 CWE-862 08/04/2026

WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin <= 2.2.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations cryptocurrency-donation-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Donation Box – Bitcoin & Crypto Donations: from n/a through <= 2.2.13.

CVE-2026-39690 Média · 5.3 CWE-862 08/04/2026

WordPress Author Avatars List/Block plugin <= 2.1.25 - Broken Access Control vulnerability

Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Author Avatars List/Block: from n/a through <= 2.1.25.

CVE-2026-39689 Média · 5.3 CWE-862 08/04/2026

WordPress eShipper Commerce plugin <= 2.16.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in eshipper eShipper Commerce eshipper-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eShipper Commerce: from n/a through <= 2.16.12.

CVE-2026-39688 Média · 5.3 CWE-862 08/04/2026

WordPress WP Frontend Profile plugin <= 1.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Glowlogix WP Frontend Profile wp-front-end-profile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Frontend Profile: from n/a through <= 1.3.9.

CVE-2026-39687 Média · 5.3 CWE-862 08/04/2026

WordPress Rapid Car Check Vehicle Data plugin <= 2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rapid Car Check Rapid Car Check Vehicle Data free-vehicle-data-uk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rapid Car Check Vehicle Data: from n/a through <= 2.0.

CVE-2026-39685 Média · 5.3 CWE-862 08/04/2026

WordPress The Moneytizer plugin <= 10.0.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in lvaudore The Moneytizer the-moneytizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Moneytizer: from n/a through <= 10.0.10.

CVE-2026-39682 Média · 5.3 CWE-862 08/04/2026

WordPress linkPizza-Manager plugin <= 5.5.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects linkPizza-Manager: from n/a through <= 5.5.5.

CVE-2026-39680 Média · 5.3 CWE-862 08/04/2026

WordPress Diet Calorie Calculator plugin <= 1.1.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in MWP Development Diet Calorie Calculator diet-calorie-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Diet Calorie Calculator: from n/a through <= 1.1.1.