CVE-2026-89000 to CVE-2026-89999

61 CVEs with public proof-of-concept exploits.

• CVE-2026-890001 PoCWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run
• CVE-2026-890011 PoCWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings
• CVE-2026-890021 PoCWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview
• CVE-2026-890031 PoCWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview
• CVE-2026-890041 PoCWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR
• CVE-2026-890051 PoCWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category
• CVE-2026-890061 PoCWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import
• CVE-2026-890071 PoCBookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization
• CVE-2026-890081 PoCBookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure
• CVE-2026-890091 PoCWAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server
• CVE-2026-890101 PoCWAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server
• CVE-2026-890121 PoCDolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter
• CVE-2026-890132 PoCsDolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
• CVE-2026-890262 PoCsIssabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
• CVE-2026-890341 PoCTCH QRing R20_B006 Unauthenticated BLE Access
• CVE-2026-890381 PoCVerizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity
• CVE-2026-890501 PoCQuads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment Bypass via Unverified Success Return URL
• CVE-2026-890551 PoCCustomer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]'…
• CVE-2026-890631 PoCOnline Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and…
• CVE-2026-890781 PoCDouble Free in GitLab
• CVE-2026-890791 PoCTheme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
• CVE-2026-890801 PoCReally Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion
• CVE-2026-891901 PoCRobin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax
• CVE-2026-891931 PoCRobin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parser
• CVE-2026-891951 PoCSite Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists
• CVE-2026-892131 PoCLlavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter
• CVE-2026-892141 PoCWpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission
• CVE-2026-892321 PoCRecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter
• CVE-2026-892341 PoCWP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter
• CVE-2026-892351 PoCTestimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter
• CVE-2026-892361 PoCSaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parameters
• CVE-2026-892371 PoCBluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters
• CVE-2026-892601 PoCMoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint
• CVE-2026-892611 PoCMoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints
• CVE-2026-892621 PoCMoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
• CVE-2026-892631 PoCMoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint
• CVE-2026-892641 PoCMoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity
• CVE-2026-892651 PoCMoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint
• CVE-2026-892691 PoCWP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode
• CVE-2026-892711 PoCWP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile
• CVE-2026-892743 PoCsWP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
• CVE-2026-892821 PoCCVE-2026-89282
• CVE-2026-892831 PoCWP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite
• CVE-2026-892851 PoCDatalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action
• CVE-2026-892871 PoCASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameter
• CVE-2026-892881 PoCFast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter
• CVE-2026-892891 PoCFast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint
• CVE-2026-892961 PoCPro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter
• CVE-2026-892971 PoCLoja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter
• CVE-2026-892991 PoCWP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter
• CVE-2026-893001 PoCWP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients
• CVE-2026-893021 PoCPost Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter
• CVE-2026-893031 PoCPost Voting System <= 1.0 - Subscriber+ SQLi via 'row' Parameter
• CVE-2026-893041 PoCPaymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' Parameter
• CVE-2026-893051 PoCPaymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter
• CVE-2026-893271 PoCFluentBoards < 2.0.15 - Board Member+ Comment Author Spoofing via 'comment_by' Parameter
• CVE-2026-893281 PoCFluentBoards < 2.0.15 - Board Member+ Board Membership and Public Access Modification
• CVE-2026-893311 PoCFluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints
• CVE-2026-894071 PoCjackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
• CVE-2026-894111 PoCPaymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent
• CVE-2026-894251 PoCjackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth