🕵️ RESEARCH & DEEP DIVES
-
EmbedPress plugin before 4.6.4 lets Contributors modify site-wide Google Reviews (CVE-2026-84927)
A missing authorization flaw in EmbedPress's Google Reviews REST API lets Contributor-level users alter site-wide review data.- Affects WordPress sites running the EmbedPress plugin versions 4.6.0 through 4.6.3 (fixed in 4.6.4).
- Missing authorization check (CWE-862) on a Google Reviews REST API route allows Contributor-role users and above to modify a site-wide store.
- Attackers can delete administrator-configured review entries and inject their own, which render publicly across the site.
- A related flaw (CVE-2026-84926) exposes administrator data via the same Google Reviews REST routes to contributor-level users.
- Issued as CVE-2026-84927, assigned by WPScan; credited to Artus KG.
📄 Source: wpscan.com · 📎 Coverage: radar.offseq.com · 👁 via CVE ThreatInt
-
Eventin WordPress plugin before 4.1.22 lets contributors hijack site homepage via missing REST authorization
The Eventin WordPress plugin before 4.1.22 lacks authorization checks on event-management REST routes, letting contributor-level users hijack the site's front page.- Affects sites running the Eventin event management plugin (wp-event-solution) in versions before 4.1.22.
- Several event-management REST routes are missing authorization checks (CWE-862), tracked as CVE-2026-84901.
- Contributor-level users and above can change the site's front-page setting to an event they do not own.
- They can also create, edit and delete global event and speaker taxonomy terms they should not manage.
- Vulnerability found by Sai Praneeth Koti, coordinated by WPScan; a related path traversal flaw (CVE-2026-84898) affects versions before 4.1.21.
📄 Source: wpscan.com · 📎 Coverage: radar.offseq.com · 👁 via CVE ThreatInt
-
Divi through 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via... — CVE ThreatInt
-
Welcart e-Commerce through 2.12.1 - Unauthenticated Arbitrary File Deletion via PH... — CVE ThreatInt
-
Spam protection, Honeypot, Anti-Spam by CleanTalk through 6.86 - Unauthenticated S... — CVE ThreatInt
-
Beaver Builder Plugin (Pro Version) through 2.11.0.1 - Reflected Cross-Site Script... — CVE ThreatInt
-
YT Player before 2.1.0 - Contributor+ SQLi via ytp_ajaxThe Video Player for YouTub... — CVE ThreatInt
-
EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumpti... — CVE ThreatInt
-
HT Menu before 1.2.7 - Subscriber+ Stored XSS via Menu SettingsThe HT Menu WordPre... — CVE ThreatInt
-
JCH Optimize before 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task OverrideT... — CVE ThreatInt
-
Joli Table Of Contents before 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Th... — CVE ThreatInt
-
CatFolders Document Gallery before 2.0.7 - Author+ Stored XSS via titleTag Block A... — CVE ThreatInt
-
EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Go... — CVE ThreatInt
-
RE: https:// mastodon.social/@eff/117215319 335459732 I suspect a lot of people should transform their EFF donations to... — @GossiTheDog@cyberplace.social
-
SonicWall NSM On-Prem RCE via OS Command Injection (CVE-2026-78327) — thehackerwire.com (discovered)
-
Cyber Talk 13 Qualys: What Security Leaders Can Learn From Its Evolution From Vulnerability Scanning to Risk Operations — securityboulevard.com (discovered)
📋 ADVISORIES
- 📄 Source for Divi WordPress theme ≤4.27.6 vulnerable to DOM-based stored XSS via video slider image_src parameter — wordfence.com