10167 matches found
PT-2026-78332
Name of the Vulnerable Software and Affected Versions Community by PeepSo versions prior to 9.0.5.3 Description An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the...
PT-2026-78270
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...
WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ SSRF via proSol_url_validate vulnerability
Subscriber+ SSRF via proSolurlvalidate vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...
WordPress WPC Admin Columns plugin < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability
Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WPC Admin Columns versions 2.3.4...
WordPress RT Mega Menu plugin < 1.5.2 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Shivamani Vastrala in WordPress Plugin RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg versions 1.5.2...
WordPress wpForo Forum plugin < 3.1.2 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin wpForo Forum versions 3.1.2...
CVE-2026-74004
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-73995
Subscriber Broken Authentication in User Registration = 5.2.6 versions...
CVE-2026-73404
Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...
CVE-2026-73396
Subscriber Broken Authentication in MWB HubSpot for WooCommerce = 1.6.7 versions...
CVE-2026-73359
Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...
CVE-2026-73189
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-14858...
CVE-2026-68568
Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...
CVE-2026-66634
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
CVE-2026-32467
Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...
CVE-2026-32466
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-28191
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...
CVE-2026-74004 WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-74004
The WordPress plugin "Gravity Booster – Styles & Layouts for Gravity Forms" (versions ≤ 6.0) has a broken access control flaw exploitable by authenticated subscribers, allowing unauthorized access to plugin functions. CVSS 3.1 score is 5.4 (MEDIUM) with network attack vector, low privileges requi...
CVE-2026-74004 WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...