CVE-2026-72585-PoC

CVE-2026-72585 — Grafana: CVE-2026-21724の不完全な修正により、Editorロールが保護されたコンタクトポイントを削除できる 製品: Grafana Grafana Labs — 13.2.0まで ファイル: pkg/services/ngalert/provisioning/contactpoints.go CWE: CWE-284 — 不適切なアクセス制御 CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N — 6.5 中 CNA: Turan Security · CVEレコード 関連:...

CVE-2026-78364

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

EUVD-2026-68158

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

CVE-2026-77786

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

CVE-2026-77786 Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

CVE-2026-77786

Rank Math SEO for WordPress, before version 1.0.277 , fails to verify that the user requesting an automated SEO fix holds the WordPress capability required for the settings being changed. The specific fix-site-seo ability allows users with the Editor role (or higher) to modify site-wide core Word...

EUVD-2026-68059

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

CVE-2026-78271

Editor Privilege Escalation in FluentCRM Pro = 3.1.12 versions...

CVE-2026-81272 WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability

Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...

CVE-2026-81272

CVE-2026-81272 affects the WordPress FluentPlayer Pro plugin in versions 1.3.2 and below , where an Editor-level Broken Access Control flaw allows a user with the Editor role to perform actions they should not be permitted to. The CVSS 3.1 score is 4.9 (MEDIUM) with the vector AV:N/AC:L/PR:H/UI:N...

CVE-2026-78276 WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability

Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78276

CVE-2026-78276 affects the WordPress Fluent Boards Pro plugin, versions 2.0.11 and earlier , where an Editor-level user can perform PHP Object Injection , leading to potential high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.2 / HIGH ). The vulnerability is network-re...

CVE-2026-78275

This Arbitrary File Deletion vulnerability affects the WordPress Fluent Boards Pro plugin in versions ≤ 2.0.11 . The flaw requires an authenticated user with Editor privileges and is scored CVSS 6.8 (Medium) with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, indicating a high availability impa...

CVE-2026-78275 WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability

Editor Arbitrary File Deletion in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78274 WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability

Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78274

CVE-2026-78274 affects the WordPress Fluent Boards Pro plugin in versions

EUVD-2026-66935

Editor Privilege Escalation in FluentCRM Pro = 3.1.12 versions...

CVE-2026-78271

CVE-2026-78271 is an Editor Privilege Escalation vulnerability in the WordPress FluentCRM Pro plugin, affecting versions 3.1.12 and earlier . The flaw was discovered by Ananda Dhakal via Patchstack. It allows an authenticated user with the Editor role to escalate privileges, rated CVSS 7.2 (HIGH)...

CVE-2026-78271 WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability

Editor Privilege Escalation in FluentCRM Pro = 3.1.12 versions...

CVE-2026-13415

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...