WordPress WP User Frontend Pro plugin <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin WP User Frontend Pro versions = 4.1.3...

WordPress MasterStudy LMS Pro plugin <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin MasterStudy LMS Pro versions = 4.7.0...

CVE-2023-4282

The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'adminpostremove' and 'removeprivatedata' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or...

WordPress eaSYNC plugin < 1.3.15 - Subscriber+ PayPal Settings Update vulnerability

Subscriber+ PayPal Settings Update vulnerability discovered by Vuln Seeker Cybersecurity Team in WordPress Plugin eaSYNC versions 1.3.15...

WordPress Woocommerce Multiple Addresses plugin <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Chuck in WordPress Plugin Woocommerce Multiple Addresses versions = 1.0.7.1...

WordPress BuddyBoss Platform plugin <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name' vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'inviteename' vulnerability discovered by Kaique Peres in WordPress Plugin Buddyboss Platform versions = 2.8.50...

WordPress WP Statistics plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary plugin Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary plugin Settings Update vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin WP Statistics versions = 14.13.3...

WordPress SecuPress Free plugin <= 2.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation vulnerability discovered by mikemyers in WordPress Plugin SecuPress Free versions = 2.3.9...

WordPress Woocommerce Automatic Order Printing plugin <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Order Information Disclosure vulnerability discovered by Lucio Sá in WordPress Plugin Woocommerce Automatic Order Printing versions = 4.1...

WordPress Industrial Lite Theme <= 1.0.8 is vulnerable to Broken Access Control

Software Industrial Lite Type Theme Vulnerable versions = 1.0.8 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-26955 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1a08c3e67c74 Credits Mika Required privilege Subscrib...

WordPress Eazy Plugin Manager plugin <= 4.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aiden in WordPress Plugin Eazy Plugin Manager versions = 4.3.0...

WordPress CM Registration and Invitation Codes plugin <= 2.5.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin CM Registration and Invitation Codes versions = 2.5.6...

WordPress Bookingor plugin <= 2.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Pham Van Tam in WordPress Plugin Bookingor versions = 2.0.1...

WordPress RegistrationMagic plugin <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin RegistrationMagic versions = 6.0.4.3...

WordPress TuriTop Booking System plugin <= 1.0.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin TuriTop Booking System versions = 1.0.10...

WordPress RestroPress plugin <= 3.2.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin RestroPress versions = 3.2.4.2...

WordPress Export All Post Meta Plugin <= 1.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Hoang Tuan Kiet in WordPress Plugin Export All Post Meta versions = 1.2.1...

WordPress mb.YTPlayer plugin <= 3.3.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin mb.YTPlayer versions = 3.3.8...

WordPress Donate Me Plugin <= 1.2.5 - Stored Cross-Site Scripting vulnerability

Stored Cross-Site Scripting vulnerability discovered by Khang Duong in WordPress Plugin Donate Me versions = 1.2.5...

WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin <= 2.2.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by NAWardRox in WordPress Plugin Ai Auto Tool Content Writing Assistant Gemini Writer, ChatGPT All in One versions = 2.2.6...