Lucene search
+L

10126 matches found

EUVD
EUVD
added 2026/08/27 9:00 a.m.12 views

EUVD-2026-66942

Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...

8.5CVSS5.8AI score0.00342EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 8:59 a.m.24 views

CVE-2026-78273

CVE-2026-78273 affects the Fluent Boards Pro WordPress plugin in versions 2.0.11 and earlier . The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable by a user with subscriber-level privileges. The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, in...

6.5CVSS5AI score0.00211EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/27 8:59 a.m.12 views

EUVD-2026-66936

Subscriber Cross Site Scripting XSS in Fluent Boards Pro = 2.0.11 versions...

6.5CVSS5AI score0.00211EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 8:59 a.m.31 views

CVE-2026-78273 WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Fluent Boards Pro = 2.0.11 versions...

6.5CVSS0.00211EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 8:59 a.m.28 views

CVE-2026-32550

CVE-2026-32550 is a SQL Injection vulnerability in the WordPress Kadence Shop Kit plugin , affecting versions ≤ 3.0.6 . The vulnerability requires Subscriber-level privileges (low) and can be exploited over the network with no user interaction, as indicated by the CVSS 3.1 vector (AV:N/AC:L/PR:L/...

8.5CVSS5.8AI score0.00342EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/27 8:59 a.m.13 views

EUVD-2026-66990

Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

8.5CVSS5.8AI score0.00342EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 8:59 a.m.25 views

CVE-2026-32564

CVE-2026-32564 is a Subscriber-level SQL Injection in the ACPT (Pro) – Custom Post Types Plugin for WordPress (versions ≤ 2.0.63 ), discovered by VDsec. The vulnerability allows a low-privilege (Subscriber) authenticated user to inject SQL, resulting in HIGH confidentiality impact with changed sc...

8.5CVSS5.8AI score0.00342EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/27 8:59 a.m.14 views

EUVD-2026-66989

Subscriber SQL Injection in Kadence Shop Kit = 3.0.6 versions...

8.5CVSS5.8AI score0.00342EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 8:59 a.m.35 views

CVE-2026-32564 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability

Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

8.5CVSS0.00342EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 8:59 a.m.35 views

CVE-2026-32550 WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability

Subscriber SQL Injection in Kadence Shop Kit = 3.0.6 versions...

8.5CVSS0.00342EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 8:59 a.m.39 views

CVE-2026-81279

The WordPress plugin Push Notification for Post and BuddyPress versions

5.4CVSS5.1AI score0.0022EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 8:59 a.m.38 views

CVE-2026-81279 WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

5.4CVSS0.0022EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/27 8:59 a.m.13 views

EUVD-2026-66986

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

5.4CVSS5.1AI score0.0022EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/08/27 7:55 a.m.9 views

WordPress AI Engine plugin < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription vulnerability

Subscriber+ Arbitrary File Read via Audio Transcription vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.6...

5CVSS5.2AI score0.00225EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/08/27 6:17 a.m.15 views

CVE-2026-78139

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...

4.3CVSS0.00152EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/27 6:17 a.m.16 views

CVE-2026-78138

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

4.3CVSS0.00176EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/27 6:17 a.m.16 views

CVE-2026-77016

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...

9.6CVSS0.00241EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/27 6:17 a.m.20 views

CVE-2026-77018

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

8.8CVSS0.00406EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/27 6:17 a.m.15 views

CVE-2026-77017

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

7.7CVSS0.00249EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/08/27 6:00 a.m.9 views

WordPress Finale Lite plugin < 2.21.0 - Subscriber+ Campaign Configuration Disclosure vulnerability

Subscriber+ Campaign Configuration Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Finale Lite versions 2.21.0...

4.3CVSS5.2AI score0.00176EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder