CVE-2026-7544

MediumCVSS 4.3/10Last modified Jul 13, 2026

Description

The Mux Video Uploader plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the muxvideo_enqueue_settings_script. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including Mux API credentials.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jul 11, 2026
Last modified: Jul 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-75457.3A weakness has been identified in SourceCodester Advanced School Management System 1.0. The affected element is an unknown function of the f CVE-2026-754588.1The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege esca CVE-2026-75469.8A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. The impacted element is the function find_host_ip of t CVE-2026-754606.5XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/CVE-2026-754648.1OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().CVE-2026-754657.5The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to CVE-2026-754666.5libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image wi CVE-2026-75474.9The Woosa – Marktplaats for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in versions up to and i CVE-2026-754763.1Tanium addressed a compression bomb vulnerability in Threat Response.CVE-2026-754797.5JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attack CVE-2026-75488.8A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cg CVE-2026-754806.5OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticat