CVE-2026-10530

MediumCVSS 5.3/10Last modified Jun 22, 2026

Description

The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jun 22, 2026
Last modified: Jun 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1053025.7A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mappe CVE-2026-1053055.4A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devi CVE-2026-1053066.5A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the CVE-2026-1053077.3A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the compone CVE-2026-105315.4The AI Share & Summarize WordPress plugin before 2.0.4 does not sanitise and escape some of its shortcode attributes before outputting them CVE-2026-1053117.7The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set s CVE-2026-1053129.9A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container imag CVE-2026-1053147.5Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file CVE-2026-1053154.7A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsear CVE-2026-1053167.1The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available CVE-2026-1053178.5Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.CVE-2026-1053187.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newslette