341329 matches found
CVE-2026-95687
The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing a...
CVE-2026-103494
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...
CVE-2026-103494
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...
CVE-2026-103494
JetBrains YouTrack versions prior to 2026.2.19422 are vulnerable to a privilege escalation flaw. This vulnerability is triggered through user group membership changes . No specific exploit details or in-the-wild exploitation information are provided in the documents. Remediation is available in v...
EUVD-2026-90585
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...
CVE-2026-103490
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...
CVE-2026-103490
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...
CVE-2026-103490
JetBrains YouTrack versions prior to 2026.2.19422 are susceptible to a privilege escalation vulnerability. The flaw is triggered through the use of user group links . This vulnerability has a HIGH base severity score of 7.2, with impacts on confidentiality, integrity, and availability.
EUVD-2026-90581
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...
CVE-2026-95687
The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to and including 2.0.0 . The root cause is the plugin's failure to properly validate a target user's role before issuing a new authentication session. An a...
EUVD-2026-90568
The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing a...
CVE-2026-95687 WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint
The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing a...
CVE-2026-95687 WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint
The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing a...
CVE-2026-19807
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...
CVE-2026-15989
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...
CVE-2026-19807
The ByteCoreStack – MCP Connector for AI Tools WordPress plugin is vulnerable to Privilege Escalation in all versions up to and including 1.2.3 . The flaw exists in the wp_update_user_meta MCP tool within the execute_tool function, which improperly gates writes using current_user_can('edit_user',...
EUVD-2026-90548
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...
CVE-2026-19807 ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...
CVE-2026-19807 ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...
CVE-2026-15989 Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function whitelisting the client-submitted 'role' key and copying it into the...