{"items":[{"id":"CVE-2026-54239","published":"2026-09-17T18:25:36.503Z","updated":"2026-09-18T18:33:34.727Z","title":"FaustWP  — Authentication Bypass via Initialization Vector Modification in Token Envelope","severity":"HIGH","score":8.8,"vendor":"wpengine","product":"faustjs","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-8382","published":"2026-05-31T02:28:00.276Z","updated":"2026-06-01T10:33:23.161Z","title":"Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters","severity":"MEDIUM","score":5.3,"vendor":"wpengine","product":"Advanced Custom Fields (ACF®)","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2026-4029","published":"2026-05-14T12:32:04.851Z","updated":"2026-05-14T15:57:55.982Z","title":"Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export","severity":"HIGH","score":7.5,"vendor":"wpengine","product":"Database Backup for WordPress","kev":false,"epss":0.0041,"kevAdded":null},{"id":"CVE-2026-4030","published":"2026-05-14T12:32:04.381Z","updated":"2026-05-14T18:30:42.046Z","title":"Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion","severity":"HIGH","score":8.1,"vendor":"wpengine","product":"Database Backup for WordPress","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2026-4031","published":"2026-05-14T12:32:02.352Z","updated":"2026-05-14T19:51:56.623Z","title":"Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception","severity":"HIGH","score":7.5,"vendor":"wpengine","product":"Database Backup for WordPress","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-4812","published":"2026-04-15T01:25:17.540Z","updated":"2026-04-15T16:01:25.621Z","title":"Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters","severity":"MEDIUM","score":5.3,"vendor":"wpengine","product":"Advanced Custom Fields (ACF®)","kev":false,"epss":0.0091,"kevAdded":null},{"id":"CVE-2025-11427","published":"2025-11-18T11:00:48.436Z","updated":"2026-04-08T16:50:54.588Z","title":"WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery","severity":"MEDIUM","score":5.8,"vendor":"wpengine","product":"WP Migrate Lite – Migration Made Easy","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2022-4974","published":"2024-10-16T06:43:30.014Z","updated":"2026-04-08T16:46:54.861Z","title":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","severity":"MEDIUM","score":6.3,"vendor":"dashlabsltd","product":"YASR – Yet Another Star Rating Plugin for WordPress","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2023-6701","published":"2024-02-05T21:22:04.222Z","updated":"2026-04-08T17:29:24.390Z","title":"Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field","severity":"MEDIUM","score":6.4,"vendor":"wpengine","product":"Advanced Custom Fields (ACF®)","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2023-6933","published":"2024-02-05T21:21:53.045Z","updated":"2026-04-08T17:05:28.946Z","title":"Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection","severity":"HIGH","score":8.8,"vendor":"wpengine","product":"Better Search Replace","kev":false,"epss":0.68047,"kevAdded":null}]}