CVE-2026-66456

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

CVE-2026-27535

Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...

EUVD-2026-57876

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

CVE-2026-66456 WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

CVE-2026-66456

CVE-2026-66456 concerns the WordPress plugin Profile Extra Fields by BestWebSoft , specifically versions ≤ 1.3.4. The vulnerability is a Subscriber Cross Site Scripting (XSS) flaw in the profile extra fields. The provided documents identify the affected product and the vulnerable component but do...

CVE-2026-66456

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

CVE-2026-27535 WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...

EUVD-2026-57933

Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...

CVE-2026-27535

CVE-2026-27535 affects the WordPress Solace Extra plugin up to version 1.6.0. The vulnerability is described as Broken Access Control, enabling lower-privilege attackers to access restricted functionality. The CVSS 3.1 base score is 7.1 (High), with Network attack vector, Low attack complexity, P...

PT-2026-71563

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

PT-2026-71498

Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...

WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dahmani Toumi pegaSUS in WordPress Plugin Solace Extra versions = 1.6.0...

Astra Linux – Vulnerability in exiv2

Exiv2 is a C++ library and a command-line utility for reading, writing, deleting, and modifying image metadata in formats such as Exif, IPTC, XMP, and ICC. Prior to version 0.28.8, a buffer overflow vulnerability was discovered in Exiv2. The vulnerability lies in the preview component, which only...

CVE-2026-16965

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

CVE-2026-16965

The CVE-2026-16965 entry concerns the Solace Extra WordPress plugin, affected version prior to 1.6.1. The vulnerability arises from missing capability and nonce checks in an AJAX action, enabling any authenticated user (e.g., a subscriber, and via CSRF any logged-in user) to update post meta on a...

CVE-2026-16965 Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

EUVD-2026-54889

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

CVE-2026-16948

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...

CVE-2026-16948

The CVE-2026-16948 entry documents a vulnerability in the Solace Extra WordPress plugin prior to version 1.6.1 where several AJAX actions lack proper capability checks and the admin nonce is exposed on pages reachable by low-privileged users. This permits users with a role as low as Subscriber to...

EUVD-2026-54743

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...