274 matches found
PublishPress Capabilities < 2.3.1 - Missing Authorization
The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator. id: CVE-2021-25032...
CVE-2026-39444
Authorization Bypass Through User-Controlled Key vulnerability in PublishPress PublishPress Series organize-series allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Series: from n/a through 3.1.3...
CVE-2026-39444 WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in PublishPress PublishPress Series organize-series allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Series: from n/a through 3.1.3...
CVE-2026-39444
The PublishPress Series WordPress plugin (versions 3.1.3 and below ) is vulnerable to an Authorization Bypass Through User-Controlled Key vulnerability. This flaw allows for the exploitation of incorrectly configured access control security levels , specifically identified as an Insecure Direct O...
EUVD-2026-91662
Authorization Bypass Through User-Controlled Key vulnerability in PublishPress PublishPress Series organize-series allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Series: from n/a through 3.1.3...
WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by dcs in WordPress Plugin PublishPress Series versions = 3.1.3...
CVE-2021-25032
CVE-2021-25032 PublishPress Capabilities 2.2 - 2.3 - Unauthenticated Arbitrary Options Update to Blog Compromise Description The plugin does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to t...
CVE-2026-94487
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...
CVE-2026-94487 WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...
CVE-2026-94487
The PublishPress Capabilities WordPress plugin, in versions
CVE-2026-94487 WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...
EUVD-2026-85480
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...
WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Intrudify in WordPress Plugin PublishPress Capabilities versions = 2.50.1...
CVE-2026-94487: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...
PT-2026-97465
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...
CVE-2026-74005
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...
CVE-2026-66630
Administrator SQL Injection in PublishPress Series = 3.1.3 versions...
CVE-2026-66617
Contributor Cross Site Scripting XSS in PublishPress Series = 3.1.3 versions...