200 matches found
PublishPress Capabilities < 2.3.1 - Missing Authorization
The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator. id: CVE-2021-25032...
CVE-2021-25032
CVE-2021-25032 PublishPress Capabilities 2.2 - 2.3 - 未认证的任意选项更新导致博客被入侵 描述 该插件在通过 init 钩子更新插件设置时，未进行授权和 CSRF 检查，也未确保要更新的选项属于该插件。因此，未认证的攻击者可以更新任意博客选项，例如默认角色，从而使任何新注册的用户都能获得管理员角色。 概念验证 root@kitploit: POST /wp-admin/admin.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01...
CVE-2026-75927
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...
EUVD-2026-74758
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...
CVE-2026-75927 PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...
CVE-2026-75927
CVE-2026-75927 affects the PublishPress Capabilities WordPress plugin (all versions ≤ 2.50.0 ). The root cause is the addPluginCapabilities() function, which unconditionally grants the Editor role all 15 manage_capabilities_* capabilities via a hard-coded $eligible_roles assignment that executes ...
WordPress User Role Editor – PublishPress Capabilities: Access Control and User Roles plugin <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant vulnerability
Authenticated Editor+ Privilege Escalation to Fresh-Install Default Capability Grant vulnerability discovered by Wordfence PRISM in WordPress Plugin PublishPress Capabilities versions = 2.50.0...
CVE-2026-84771
This unauthenticated IDOR vulnerability affects the WordPress PublishPress Permissions plugin in versions 4.8.3 and earlier . Discovered by Brobicho and assigned by Patchstack , it allows a remote attacker with no privileges to access resources they should not, resulting in a low confidentiality ...
CVE-2026-84771 WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...
EUVD-2026-69939
Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...
WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Brobicho in WordPress Plugin PublishPress Permissions versions = 4.8.3...
EUVD-2026-62212
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0...
CVE-2026-27365
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0...
CVE-2026-27365 WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0...
CVE-2026-27365
The WordPress PublishPress Series plugin (versions through 2.17.0) has a stored XSS flaw from improper input neutralization during page generation. Patchstack rates it MEDIUM (CVSS 5.9) requiring high privileges and user interaction. No exploitation data is provided. Upgrade to a patched version ...
WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by PPzzAArr in WordPress Plugin PublishPress Series versions = 2.17.0...
PT-2026-78245
Name of the Vulnerable Software and Affected Versions PublishPress Series versions prior to 2.17.1 Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server and lat...
CVE-2026-28183
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...