23251 matches found
CVE-2026-4882 User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAFAJAX::methodupload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary...
CVE-2026-4882
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAFAJAX::methodupload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary...
CVE-2026-7641
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the saveextrauserprofilefields function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site e.g...
CVE-2026-7641
The WordPress plugin Import and export users and customers (versions ≤ 2.0.8) is vulnerable to Privilege Escalation. The root cause is an incomplete blocklist for multisite capability meta keys: primary-site keys (e.g., wp_capabilities, wp_user_level) are blocked, but multisite keys (e.g., wp_2_c...
CVE-2026-7641 Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the saveextrauserprofilefields function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site e.g...
CVE-2026-7641 Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the saveextrauserprofilefields function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site e.g...
EUVD-2026-26740
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the saveextrauserprofilefields function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site e.g...
PT-2026-36582
Name of the Vulnerable Software and Affected Versions Profile Builder Pro versions prior to 3.14.6 Description The Profile Builder Pro plugin for WordPress is susceptible to PHP Object Injection. This occurs because the wppb request users pins action callback AJAX handler uses the maybe unseriali...
WordPress plugin Import and export users and customers 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
WordPress plugin Profile Builder Pro 代码问题漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...
PT-2026-36572
Name of the Vulnerable Software and Affected Versions Import and export users and customers plugin for WordPress versions prior to 2.0.9 Description An issue exists in the save extra user profile fields function where an incomplete blocklist fails to restrict capability meta keys for subsites in ...
PT-2026-36566
Name of the Vulnerable Software and Affected Versions User Registration Advanced Fields versions prior to 1.6.21 Description The User Registration Advanced Fields plugin for WordPress allows unauthenticated attackers to upload arbitrary files to the server. This issue stems from missing file type...
CVE-2026-7567
creationtimestamp| type| source ---|---|--- 2026-05-01 11:11:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkrymnukmi2p 2026-05-02 08:00:04+00:00| seen| https://t.me/GithubRedTeam/82445 2026-05-02 11:00:10+00:00| seen| Telegram/tQatHScNUYuJveIo384qXaKUGUcjtuIRc0ZjHeoPypmQ...
CVE-2026-43001
creationtimestamp| type| source ---|---|--- 2026-05-01 10:56:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkrxrsdamf2i 2026-05-28 21:13:02+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mmwwsrnh6g2z...
CVE-2024-13362
creationtimestamp| type| source ---|---|--- 2026-05-01 06:54:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkrkanvanl2i 2026-05-04 22:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3ml2q3tjkdc2i 2026-05-04 23:33:06+00:00| seen|...
CVE-2026-7549
creationtimestamp| type| source ---|---|--- 2026-05-01 06:49:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkrjxp7ait2i...
CVE-1999-0559
creationtimestamp| type| source ---|---|--- 2026-05-01 05:03:10+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mkrdznvrri2r...
CVE-2026-5404
creationtimestamp| type| source ---|---|--- 2026-05-01 03:01:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkr5a26vf42p 2026-05-04 02:29:57+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3mkymuhf3uq2z...
CVE-2026-7513
creationtimestamp| type| source ---|---|--- 2026-05-01 00:31:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkqutlb4va2g 2026-05-01 03:20:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkr6clzcgi2v...
