348225 matches found
EUVD-2026-96105
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...
CVE-2026-92975 Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...
CVE-2026-92975
The Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress (versions ≤ 4.8.3 ) contains a Privilege Escalation vulnerability in the create_support_user() function. The flaw exists because the function identifies support accounts using publicly hardcoded constants—specifically ...
CVE-2026-92975 Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...
CVE-2026-77183
The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to and including 1.43.0 . The root cause is a failure to properly validate a user's identity before updating details, such as email addresses, through ...
CVE-2026-77183 FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint
The FooSales – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes...
EUVD-2026-96102
The FooSales – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes...
CVE-2026-104725 Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the processedit function, which allows any...
CVE-2026-104725
The Groundhogg WordPress plugin (versions up to and including 4.9 ) is vulnerable to Privilege Escalation due to a missing ownership and capability check on the user parameter within the process_edit() function. This flaw allows authenticated users with the edit_contacts capability to reassign a ...
EUVD-2026-96095
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the processedit function, which allows any...
CVE-2026-104725 Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the processedit function, which allows any...
CVE-2026-104766 Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the OsSettingsController::update handler iterating over attacker-supplied settings parameters...
CVE-2026-104766
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.7.3 . The root cause is that the OsSettingsController::update() handler iterates over attacker-supplied settings parameters without an allowlist...
EUVD-2026-96090
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the OsSettingsController::update handler iterating over attacker-supplied settings parameters...
CVE-2026-107645
The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implementuserregistration AJAX handler explicitly disabling Dokan's vendor-registration nonce check via addfilter'dokanregisternoncecheck', 'returnfalse' an...
CVE-2026-104898
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wpuserid' parameter due to missing validation on a user controlled key. This makes it possible for...
CVE-2026-104797
The Advanced Form Integration plugin for WordPress (versions up to and including 2.9.0 ) is vulnerable to an Authentication Bypass and Privilege Escalation . The flaw exists in the adfoin_ultimatememberac_send_data function, which handles the Ultimate Member "Update Profile Field" action. Because...
CVE-2026-107645
The Blocksy Companion plugin for WordPress (versions up to and including 2.1.58 ) is vulnerable to an unauthenticated privilege escalation via the implement_user_registration() AJAX handler. The flaw exists because the plugin explicitly disables Dokan's vendor-registration nonce check and subsequ...
CVE-2026-107645 Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter
The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implementuserregistration AJAX handler explicitly disabling Dokan's vendor-registration nonce check via addfilter'dokanregisternoncecheck', 'returnfalse' an...
EUVD-2026-96038
The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implementuserregistration AJAX handler explicitly disabling Dokan's vendor-registration nonce check via addfilter'dokanregisternoncecheck', 'returnfalse' an...