CVE-2026-88931 Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

WordPress Social Web Suite plugin <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update vulnerability

Unauthenticated Arbitrary Plugin Settings Update vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Social Web Suite versions = 4.1.12...

WordPress All in One Files Upload plugin < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update vulnerability

Subscriber+ Arbitrary Plugin Settings Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin All in One Files Upload versions 2.0.17...

CVE-2026-18364 Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

CVE-2026-18364

The zportals WordPress plugin versions prior to 6.4.2 is vulnerable to an unauthorized settings modification. The root cause is the failure to perform capability or nonce checks on several AJAX actions . This allows users with low-privileged subscriber-level accounts to modify the plugin's stored...

WordPress zportals plugin < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update vulnerability

Subscriber+ Arbitrary Plugin Settings Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Zportals versions 6.4.2...

CVE-2020-36731: Improper Neutralization of Input During Web Page Generation

The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction function...

WP Prayer < 1.6.7 - Arbitrary Plugin Settings Update via CSRF

The plugin did not properly check for CSRF in some of its module functions, allowing attacker to make logged in admin change all plugin's settings including the email settings for example. v1.6.6 fixed most of CSRF checks, but the one in model.emailsettings.php was improperly fixed bypass still...