CVE-2026-16265

CVE-2026-16265 — WP Maps This repository is intended as a technical reference for an already disclosed vulnerability. It does not include a weaponized denial-of-service script. Overview Item| Details ---|--- CVE| CVE-2026-16265 Product| WP Maps Affected versions| 4.9.7 Fixed version| 4.9.7...

EUVD-2026-125984

The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and attach a payment method of their choosi...

WordPress Bit File Manager < 6.9.1 - Arbitrary File Read

The Bit File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory. id: CVE-2026-17540 info: name: WordPress Bit File...

WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server. id:...

CVE-2023-2916

CVE-2023-2916 CVE-2023-2916 PoC The InfiniteWP Client plugin for WordPress, in versions up to and including 1.11.1, is vulnerable to a Sensitive Information Exposure flaw. This vulnerability allows authenticated attackers with subscriber-level permissions or above to extract sensitive data,...

CVE-2023-6985

CVE-2023-6985 10Web AI Assistant – AI content writing assistant = 1.0.18 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description Description The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized...

CVE-2024-12558

CVE-2024-12558 WP BASE Booking of Appointments, Services and Events history.pushState'', '', '/'; document.forms0.submit;...

CVE-2023-47840

CVE-2023-47840 Qode Essential Addons = 1.5.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The Qode Essential Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

CVE-2026-120687

The Lightbox & Modal Popup WordPress Plugin (FooBox) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in versions up to and including 2.8.7 . The flaw stems from insufficient input sanitization and output escaping of the img alt attribute within .wp-caption containers . This allows un...

EUVD-2026-125938

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escapin...

EUVD-2026-125937

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fvplayervideos' parameter in all versions up to, and including, 8.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-110531

The FV Player 8 plugin for WordPress (versions up to and including 8.1.9 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the fv_player_videos parameter due to insufficient input sanitization and output escaping. An authenticated attacker with Subscriber-level access or h...

CVE-2026-18053

The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the useraccountmanager function's editprofile branch, where all submitted $POST fields are iterated and directly assigned to the...

EUVD-2026-125905

The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the useraccountmanager function's editprofile branch, where all submitted $POST fields are iterated and directly assigned to the...

CVE-2024-54379

CVE-2024-54379 Minterpress = 1.0.5 - Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update Description The Minterpress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on a functio...

WordPress Countdown, Coming Soon, Maintenance plugin <= 3.0.8 - Subscriber+ Non-Public Post Title Disclosure vulnerability

Subscriber+ Non-Public Post Title Disclosure vulnerability discovered by Huseyn in WordPress Plugin Countdown & Clock versions = 3.0.8...

PT-2026-147425

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv player videos' parameter in all versions up to, and including, 8.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

PT-2026-147420

Name of the Vulnerable Software and Affected Versions MemberDash versions prior to 1.8.8 Description An issue exists in the user account manager function's edit profile branch. A mass-assignment flaw occurs when submitted $ POST fields are iterated and assigned to the current member object via th...

CVE-2026-18053: LearnDash MemberDash: The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7

The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the useraccountmanager function's editprofile branch, where all submitted $POST fields are iterated and directly assigned to the...

PT-2026-147427

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escapin...