Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-118639

Surfer < 1.8.1.759 - Contributor+ Privilege Escalation via Editor API Key Disclosure

The Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-level access and above to read the credential and escalate to publishing arbitrary posts and other privileged actions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Surfer
CVE-2026-112222

WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability

Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Surfer Wordpress-extensions
Products
Surfer Surfer