PT-2026-71030

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary...

CVE-2026-14549

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...

EUVD-2026-55948

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...

EUVD-2026-55947

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

CVE-2026-14549

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...

CVE-2026-14549

The Ray Enterprise Translation WordPress plugin (versions up to 1.7.3) exposes an AJAX action that does not perform capability or nonce checks. This allows any authenticated user, including Subscribers, to add or delete the site’s configured languages. Affected component: WordPress plugin Ray Ent...

CVE-2026-14548

The CVE concerns the Ray Enterprise Translation WordPress plugin (affected:

CVE-2026-14941 Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions

The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerc...

CVE-2026-17017

The CVE-2026-17017 entry concerns the CubeWP Framework WordPress plugin prior to 1.1.31. The vulnerability arises because a parameter is not properly sanitized/escaped before being used in a SQL statement via an AJAX action, and there is no capability check on that action. This enables users with...

CVE-2026-17014

The CVE-2026-17014 entry affects the WP Photo Album Plus WordPress plugin prior to 9.2.07.002. The public REST endpoint action lacks capability or nonce checks, allowing unauthenticated users to delete generated album export ZIP archives stored by the plugin. This is the root cause and directly e...

EUVD-2026-54889

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

CVE-2026-16948

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...

CVE-2026-16265

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...

CVE-2026-11983

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the aiajax function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that ...

CVE-2025-9266

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...

CVE-2026-7456

The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

CVE-2026-7726

The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...

CVE-2026-7520

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-6079

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amdajaxtargettaskmanager function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all...

EUVD-2026-53285

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...