CVE-2026-119564
Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pendin
CVSS
5.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 30, 2026 · Last modified: Oct 30, 2026 · CWE-201
Not enough EPSS history yet.
Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.
- abraxaslabs.techhttps://abraxaslabs.tech/research/plausible-editor-invite
- github.comhttps://github.com/plausible/analytics
- github.comhttps://github.com/plausible/analytics/blob/v3.2.1/lib/plausible/sites.ex#L189
- github.comhttps://github.com/plausible/analytics/blob/v3.2.1/lib/plausible_web/templates/site/settings_people.html.heex#L136
- www.vulncheck.comhttps://www.vulncheck.com/advisories/plausible-analytics-through-3.2.1-site-takeover-via-exposed-invitation-ids
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-107268——
——0Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.18hCVE-2026-450498.3 HIG—
——0Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1.1dCVE-2026-482005.3 MED—
——0Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0.1dCVE-2026-1180837.5 HIG—
——0Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.1dCVE-2026-1141735.3 MED21.1%
——6The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.1dCVE-2026-1155917.5 HIG26.9%
——8Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by Supsystic: from n/a through 1.10.5.1d