CVE-2026-111965

MediumCVSS 4.3/10Last modified Oct 23, 2026

Description

The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published
Oct 23, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1119666.8The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it baCVE-2026-111976.5Insufficient policy enforcement in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendereCVE-2026-1119716.8The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names beforCVE-2026-1119724.9The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeteCVE-2026-111976The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public fronCVE-2026-111978The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing usersCVE-2026-111979The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputtCVE-2026-111989.6Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perforCVE-2026-111980The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users wiCVE-2026-111981The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who havCVE-2026-1119827.2The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on iCVE-2026-1119844.3A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file
CVE-2026-111965: Medium severity, CVSS 4.3 | Vulnix