CVE-2026-14279 Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

CVE-2026-14279

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...

CVE-2026-14279

CVE-2026-14279 affects the Wholesale Market plugin for WordPress. Vulnerable through version 2.2.2 via the ced_wholesale_request_send AJAX action. The root cause is flawed access control: the ced_wholesale_request_send_callback() only verifies a nonce and a positive user ID, then calls WP_User::a...

CVE-2026-16541

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...

EUVD-2026-59589

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...

CVE-2026-16541

The Simply Schedule Appointments WordPress plugin versions before 1.6.12.17 is vulnerable to an information disclosure flaw. The plugin fails to restrict user records returned by certain REST endpoints to only those the requester is authorized to view. This allows a user with a low-privileged sta...

CVE-2026-15948 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15948 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15312

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...

PostgreSQL row security caching disregards role modifications

...

CVE-2026-15312 Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...

CVE-2026-15312 Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...

CVE-2026-15312

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...

EUVD-2026-58836

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...

CVE-2026-15312

The CVE-2026-15312 entry concerns the Propovoice: All-in-One Client Management System WordPress plugin. Affected versions up to 1.7.8 are vulnerable to privilege escalation via the plugin’s REST create() endpoint, which fails to validate the user-supplied role against an allowlist and omits a pro...

SUSE CVE-2026-14666

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

PT-2026-72145

Name of the Vulnerable Software and Affected Versions Propovoice: All-in-One Client Management System versions prior to 1.7.9 Description An issue exists where the REST endpoint of the create function fails to validate the user-supplied role parameter against a list of permitted WordPress roles a...

PT-2026-72163

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...

CVE-2026-16541: Exposure of Sensitive Information to an Unauthorized Actor

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...

CVE-2026-15312: Improper Privilege Management

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...