https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 05:51:27 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337821 EUVD-2026-337821 https://cve.radiocsirt.org/vuln/euvd-2026-337821 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11580 <p>The Kali Forms — Contact Form &amp; Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by other Kali Forms — Contact Form &amp; Drag-and-Drop Builder WordPress plugin before 2.4.17.</p> <p>The Kali Forms — Contact Form &amp; Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by other Kali Forms — Contact Form &amp; Drag-and-Drop Builder WordPress plugin before 2.4.17.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-11580 https://cve.radiocsirt.org/vuln/ghsa-mg5f-qx7f-gf9j <p>The Kali Forms — Contact Form &amp; Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by other Kali Forms — Contact Form &amp; Drag-and-Drop Builder WordPress plugin before 2.4.17.</p> <p>The Kali Forms — Contact Form &amp; Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by other Kali Forms — Contact Form &amp; Drag-and-Drop Builder WordPress plugin before 2.4.17.</p> https://cve.radiocsirt.org/vuln/ghsa-mg5f-qx7f-gf9j