// cve index

CVEs & published findings.

Every entry below was reported privately first and is listed here only after a fix or the agreed disclosure deadline. Issues still in triage are intentionally left out until they are patched and coordinated.

Found
Reported
Fixed
Published
  1. CVE-2026-118637 Medium

    Contributor+ disclosure of private and draft downloads · Simple Download Monitor

    A shortcode in Simple Download Monitor rendered download items without checking their status. Any user with the Contributor role could show the titles and descriptions of private, draft and other non-public downloads by placing the shortcode in a post and previewing it.

    • Type Sensitive data disclosure
    • CWE 200
    • Access Contributor
    • Affected < 4.1.3
    Fixed in 4.1.3 Published WPScan advisory ↗ CVE record ↗
  2. CVE-2026-118523 Medium

    Unauthenticated disclosure of pending posts via a post status override · EventPrime

    EventPrime let a request choose which post statuses to query. A visitor without an account could override the public status filter and read pending posts that were still waiting for review and had not been published yet.

    • Type Sensitive data disclosure
    • CWE 200
    • Access Unauthenticated
    • Affected < 4.3.6.1
    Fixed in 4.3.6.1 Published WPScan advisory ↗ CVE record ↗