4149 matches found
tvsz
CVE-2018-6389 PoC node js multisite with proxy This script is based on CVE-2018-6389, a rather insidious problem in Wordpress, which unfortunately will likely not be fixed by the team developing the platform, even though it has been known for quite some time. !!! IMPORTANT BEFORE YOU CONTINUE !!!...
CVE-2026-112219
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and...
CVE-2026-111982
The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's,...
CVE-2026-111738
The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options...
CVE-2026-110537
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change th...
CVE-2026-111982
The User Profile Builder WordPress plugin, in versions prior to 4.0.5 , contains an authorization vulnerability in its front-end Edit Profile form. The plugin fails to verify if a user is authorized to modify a specific selected account, enabling a Multisite subsite Administrator to change the em...
EUVD-2026-108596
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and...
CVE-2026-112219
The Download Monitor WordPress plugin, in versions prior to 5.3.5 , contains an incorrect authorization vulnerability specifically affecting WordPress multisite environments. The plugin fails to properly restrict the management of filesystem locations to network administrators, allowing a subsite...
CVE-2026-112219 Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and...
WordPress User Profile Builder plugin < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover vulnerability
Multisite Subsite Admin+ Network Super Admin Account Takeover vulnerability discovered by Szymon Szymkowiak in WordPress Plugin Profile Builder versions 4.0.5...
WordPress Download Monitor plugin < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization vulnerability
Multisite Subsite Admin+ Incorrect Authorization vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Download Monitor versions 5.3.5...
CVE-2026-111982 Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change
The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's,...
EUVD-2026-108595
The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's,...
CVE-2026-110537
The Essential Addons for Elementor WordPress plugin, in versions before 6.8.7 , contains an Incorrect Authorization vulnerability (CWE-863). The plugin fails to verify if an administrator has permission to manage specific user accounts targeted by its login-approval feature , instead only checkin...
EUVD-2026-108593
The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options...
EUVD-2026-108591
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change th...
CVE-2026-110537 Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change th...
My Calendar WordPress Plugin - Information Disclosure
My Calendar WordPress plugin = 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parsestr in mcajaxmcjsaction endpoint, letting unauthenticated attackers access or crash sites via switchtoblog, exploit requires WordPress Multisite or Single Site setup. id:...
PT-2026-121766
The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options...
PT-2026-121769
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and...