10167 matches found
CVE-2026-68568 WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...
CVE-2026-68568
WordPress MasterStudy LMS plugin (≤ 3.7.41) allows authenticated subscribers to escalate privileges, likely by bypassing capability checks in REST endpoints or AJAX handlers. CVSS 6.3 (medium) — network attack, low privileges required. No in-the-wild exploitation reported. Upgrade to a patched ve...
CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
CVE-2026-66634
The Modal Survey WordPress plugin (versions ≤ 2.0.2.2.3) contains an IDOR flaw allowing authenticated subscribers to access or modify objects without authorization. Patchstack reports it; no patch version or exploitation evidence is provided in the documents. Upgrade to a newer version if availab...
EUVD-2026-60919
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
CVE-2026-66634
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
CVE-2026-32467
CVE-2026-32467 affects the WordPress "[Aotuman] Grab WeChat Articles" plugin up to version 2.0.1. Authenticated subscribers can trigger an SSRF by causing the server to fetch arbitrary internal/external URLs, enabling internal network probing or external requests. CVSS 6.0 MEDIUM (AV:N/AC:H/PR:L/...
CVE-2026-32467 WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability
Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...
CVE-2026-32467
Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...
EUVD-2026-60902
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-32466 WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-32466
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-32466
The Gravity Forms Bookings premium WordPress plugin (versions ≤ 2.1) contains a SQL injection flaw exploitable by authenticated subscribers. CVSS 8.5 (HIGH) reflects network access with low privileges. Patchstack reports it; no in-the-wild exploitation or patch version details are provided in the...
CVE-2026-32466 WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-28191
A privilege escalation vulnerability affects the WordPress plugin The Grid (versions
CVE-2026-28191
Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...
CVE-2026-28191 WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...
CVE-2026-28191 WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...