EUVD-2026-85796

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

CVE-2026-80513 wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

CVE-2026-80513 wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

CVE-2026-80513

The wpForo Forum WordPress plugin versions prior to 3.1.6 is vulnerable to PHP Object Injection . The root cause is a failure to restrict which classes may be instantiated during the deserialization of a user-supplied profile field value. This allows authenticated users with Subscriber-level acce...

CVE-2026-80338 CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler

The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation...

CVE-2026-82849: Authorization Bypass Through User-Controlled Key

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...

PT-2026-97707

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

PT-2026-97713

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An issue exists where the plugin fails to perform capability or nonce checks on an administrative maintenance action. A nonce is a unique token used to protect against...

CVE-2026-86583

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv with a NUL byte \0 as...

CVE-2026-95530

Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...

CVE-2026-95590

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

CVE-2026-95525

Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...

CVE-2026-94679

Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...

CVE-2026-93772

Subscriber Cross Site Scripting XSS in wpForo Forum = 3.1.5 versions...

CVE-2026-95590

The Tainacan WordPress plugin (versions

CVE-2026-95590 WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

EUVD-2026-85500

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

CVE-2026-95590 WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

CVE-2026-95530

The PixelYourSite – Your smart PIXEL (TAG) Manager WordPress plugin is vulnerable to a Subscriber Cross Site Scripting (XSS) flaw in versions

CVE-2026-95530 WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...