CVE-2026-1082

The TITLE ANIMATOR plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page form handler in `inc/settings-page.php`. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/title-animator/tags/1.0/inc/settings-page.php#L5
• https://plugins.trac.wordpress.org/browser/title-animator/trunk/inc/settings-page.php#L5
• https://www.wordfence.com/threat-intel/vulnerabilities/id/98736b9d-3e0a-40c0-900a-fbbaaac07958?source=cve

Published

Feb 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10814A vulnerability has been found in milvus-io milvus up to 2.6…7
• CVE-2026-10815A vulnerability was found in LakshayD02 Hostel-Management-Sy…6.3
• CVE-2026-10816Arbitrary File Read (Unauthenticated) in NetScaler ADC and N…7.5
• CVE-2026-10817Insufficient input validation leading to memory overread in …7.5
• CVE-2026-10818The WPForms Pro plugin for WordPress is vulnerable to Arbitr…8.1
• CVE-2026-10819Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 1…6.5
• CVE-2026-10820The Paid Membership Plugin, Ecommerce, User Registration For…8.1
• CVE-2026-10822If BIND encounters a particular invalid data structure in a …6.5
• CVE-2026-10823The YMC Filter WordPress plugin before 3.11.3 does not prope…7.5
• CVE-2026-10824The Masteriyo LMS WordPress plugin before 2.2.1 does not pe…6.5
• CVE-2026-10825A denial-of-service vulnerability exists in the WebSocket AP…7.1
• CVE-2026-10827The Spectra Legacy WordPress plugin before 2.20.0 does not …3.5