CVE-2026-17580

Name of the Vulnerable Software and Affected Versions Advanced Views versions prior to 3.9.2

Description The plugin is susceptible to sensitive information exposure through the register rest routes function. Authenticated users with subscriber-level access or higher can extract admin-authored editor content for any Layout or Post Selection post. This exposed data includes template markup, CSS code, JavaScript code, and PHP controller variables. The issue is triggered via the 'view-refresh' and 'card-refresh' API endpoints.

Recommendations Update the plugin to a version newer than 3.9.1.