CVE-2026-122063

The Newsletters plugin for WordPress is vulnerable to blind SQL Injection in all versions up to and including 4.18.2 . The root cause is insufficient escaping of the user_email parameter combined with a lack of proper preparation in the existing SQL query. Authenticated attackers with Subscriber-...

WordPress Newsletters plugin <= 4.18.2 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Newsletters versions = 4.18.2...

WordPress Bit File Manager < 6.9.1 - Arbitrary File Read

The Bit File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory. id: CVE-2026-17540 info: name: WordPress Bit File...

WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server. id:...

WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection

CBX Bookmark & Favorite WordPress plugin = 2.0.4 contains a SQL injection caused by insufficient escaping of the 'orderby' parameter, letting authenticated attackers with Subscriber-level access extract sensitive database information id: CVE-2025-13652 info: name: WordPress CBX Bookmark & Favorit...

CVE-2024-52429

CVE-2024-52429 WP Quick Setup history.pushState'', '', '/'; document.forms0.submit;...

CVE-2026-118495

Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 through 11.1.1. An unauthenticated attacker who knows a subscriber's email addre...

CVE-2026-118495 Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1

Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 through 11.1.1. An unauthenticated attacker who knows a subscriber's email addre...

EUVD-2026-124598

Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 through 11.1.1. An unauthenticated attacker who knows a subscriber's email addre...

CVE-2026-118495

The AcyMailing extension for Joomla and WordPress (versions 6.0.0 through 11.1.1 ) contains a vulnerability that allows an unauthenticated attacker to access sensitive information. By knowing a subscriber's email address , an attacker can read the subscriber's record, including a per-subscriber s...

CVE-2021-21389

CVE-2021-21389 BuddyPress 7.2.1 - REST API Privilege Escalation to RCE PoC Full Affected version: 5.0.0 to 7.2.0 User requirement: Subscriber user Method: Privilege Escalation to Administrator and trigger RCE via REST API Endpoint: /v1/members/me endpoint. How to use Docker git clone...

CVE-2024-8743-PoC

CVE-2024-8743 PoC Background Proof-of-Concept script for WordPress plugin Bit File Manager version = 6.5.7 Authenticated Subscriber+ Limited JavaScript File Upload CVE-2024-8743 vulnerability Information Description: The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for...

CVE-2024-10728

CVE-2024-10728 PostX var ultpoptionpanel =...

CVE-2023-36531

CVE-2023-36531 LiquidPoll – Advanced Polls for Creators and Brands = 3.3.68 - Missing Authorization via activateaddon Info Needs a subscriber level user and the plugin needs to be disabled. This will activate the plugin you provide. Usage usage: CVE-2023-36531.py -h -w URL -u USERNAME -p PASSWORD...

CVE-2023-2877

CVE-2023-2877 Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Usage usage: CVE-2023-2877.py -h -w URL -u USERNAME -p PASSWORD -pl PLUGIN -c CMD CVE-2023-2877 - Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Script options: -h, --help show this help message and exit -w URL,...

CVE-2025-1304

🚨 WordPress NewsBlogger Theme = 0.2.5.1 - Arbitrary File Upload CVE-2025-1304 CVSS Score: 8.8 High Vulnerability Type: Arbitrary File Upload Component: WordPress Theme CVE ID: CVE-2025-1304 🔥 Vulnerability Overview The NewsBlogger WordPress theme versions = 0.2.5.1 is vulnerable to an Arbitrary...

CVE-2026-120145 PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code

Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable...

CVE-2025-9215

StoreEngine Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Download The StoreEngine plugin contains a vulnerability in its CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2026-13764

The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the masterstudymsstmsetdiscardtransient AJAX action. This makes it possible for...

CVE-2026-15309

The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajaxsavesettings function, which accepts arbitrary POST parameters and calls updateoption with attacker-controlled keys and...