CVE-2026-8910

The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/wp-emoticon-rating/trunk/admin/wp-emo-admin.php#L101
• https://plugins.trac.wordpress.org/browser/wp-emoticon-rating/trunk/admin/wp-emo-admin.php#L107
• https://plugins.trac.wordpress.org/browser/wp-emoticon-rating/trunk/admin/wp-emo-admin.php#L130
• https://plugins.trac.wordpress.org/browser/wp-emoticon-rating/trunk/admin/wp-emo-admin.php#L136
• https://plugins.trac.wordpress.org/browser/wp-emoticon-rating/trunk/admin/wp-emo-admin.php#L18
• https://plugins.trac.wordpress.org/browser/wp-emoticon-rating/trunk/admin/wp-emo-admin.php#L76
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b2a0b560-3f5a-4d09-9cc1-e22b2a19dfe6?source=cve

Published

Jun 9, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89093The Better Messages – Chat Rooms, Group Chat, Private Messag…5.3
• CVE-2026-89094Forgejo before 16.0.4 allows remote code execution via a cra…9.9
• CVE-2026-89096A flaw was found in nfs-utils. An unauthenticated remote att…5.9
• CVE-2026-89097The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPr…4.3
• CVE-2026-89098A flaw was found in nfs-utils. The fsidd daemon improperly h…5.5
• CVE-2026-89099A race condition in the document value layer of MongoDB Serv…7.5
• CVE-2026-89100The Payment Plugins for Stripe WooCommerce plugin for WordPr…6.1
• CVE-2026-89101The Everest Forms – Contact Form, Payment Form, Quiz, Survey…6.5
• CVE-2026-89102In wolfSSL versions 5.7.2 through 5.9.2 there is a client-si…6.5
• CVE-2026-89103SAP Gateway activates the default Access Control List with h…10
• CVE-2026-89105The HybridTokenAuthenticator component of the SAP/cloud-secu…4.2
• CVE-2026-89106SAP UI5 does not perform sufficient input validation under c…4.4