WordPress Malcure Malware Shield — Removal, Repair, Monitor plugin < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion vulnerability

Multisite Subsite Admin+ Arbitrary File Write and Deletion vulnerability discovered by Charles Vosburgh in WordPress Plugin Malcure Malware Scanner versions 19.9.7...

WordPress Theme My Login plugin <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage vulnerability

Authenticated Subscriber+ Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage vulnerability discovered by Maksim Hayder trjan - Iron Digital Labs LLC in WordPress Plugin Theme My Login versions = 7.1.15...

CVE-2026-81766 Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

CVE-2026-75796

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network,...

WordPress All-in-One WP Migration and Backup plugin < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import vulnerability

Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import vulnerability discovered by Mohamed Bassia in WordPress Plugin All-in-One WP Migration versions 7.108...

CVE-2026-16623: Improper Control of Generation of Code

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...