9080 matches found
CVE-2026-16265
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...
CVE-2026-16263
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...
CVE-2026-16263 WP Maps < 4.9.7 - Subscriber+ Local File Inclusion
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...
EUVD-2026-54391
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...
CVE-2026-16265 WP Maps < 4.9.7 - Subscriber+ Denial of Service
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...
CVE-2026-16263
The CVE concerns the WP Maps WordPress plugin prior to 4.9.7. It lacks a capability check in one of its AJAX actions and fails to validate a user-controlled path before using it in a file inclusion, enabling users with a Subscriber account to include and execute arbitrary existing local PHP files...
CVE-2026-16265
The CVE-2026-16265 entry concerns the WP Maps WordPress plugin prior to version 4.9.7. It describes a vulnerability where a missing capability check in one of the plugin’s AJAX actions allows a Subscriber-level user to trigger an operation that dispatches uncontrolled recursion, exhausting server...
EUVD-2026-54392
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...
CVE-2026-16039
The CVE-2026-16039 affects the MStore API WordPress plugin prior to 4.21.0. The vendor-orders endpoint does not restrict access to the caller’s own orders, enabling any authenticated user (including Subscribers) to read all WooCommerce orders and associated customer personal information. Root cau...
CVE-2026-11907
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...
CVE-2026-11907 Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...
EUVD-2026-54366
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...
CVE-2026-11907
CVE-2026-11907 concerns the WordPress Stream plugin (
WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection
CBX Bookmark & Favorite WordPress plugin = 2.0.4 contains a SQL injection caused by insufficient escaping of the 'orderby' parameter, letting authenticated attackers with Subscriber-level access extract sensitive database information id: CVE-2025-13652 info: name: WordPress CBX Bookmark & Favorit...
CVE-2026-14306
CVE-2026-14306 affects Tutor LMS for WordPress, prior to version 3.9.14. The vulnerability is an enrollment check bypass that allows authenticated users with subscriber-level access (or higher) who are enrolled in at least one course to view paid lesson, quiz, and assignment content from other co...
CVE-2026-66711
Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...
CVE-2026-65569
Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...
CVE-2026-65552
Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...