289 matches found
WordPress WPC Admin Columns plugin < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability
Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WPC Admin Columns versions 2.3.4...
WordPress RT Mega Menu plugin < 1.5.2 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Shivamani Vastrala in WordPress Plugin RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg versions 1.5.2...
CVE-2026-74004 WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
EUVD-2026-59914
The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator m...
EUVD-2026-58863
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-72150
Name of the Vulnerable Software and Affected Versions Cookie Banner for GDPR / CCPA – WPLP Cookie Consent versions prior to 4.3.6 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrar...
CVE-2026-65582
Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...
CVE-2026-27535
Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...
CVE-2026-28181 WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...
CVE-2026-14332 Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...
CVE-2026-18962
The vulnerability CVE-2026-18962 affects the WP Photo Album Plus WordPress plugin (pre-9.2.09.002). The issue is improper authorization during front-end uploads: any authenticated user (e.g., Subscriber) can upload files into albums owned by other users or the admin because the plugin does not ve...
CVE-2026-18943 WPC Admin Columns < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure
The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators...
CVE-2026-19052
The CVE concerns the ProSolution WP Client WordPress plugin
CVE-2026-18943
The vulnerability CVE-2026-18943 affects the WPC Admin Columns WordPress plugin before version 2.3.4. One of the plugin’s AJAX actions lacks proper authorization checks, enabling users with a role as low as subscriber to read arbitrary user, post, and term metadata, including data belonging to ad...
CVE-2026-16538 TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up
The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value...
WordPress GeoDirectory plugin <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision vulnerability
Authenticated Subscriber+ Arbitrary File Deletion via 'posttype' Parameter via Query-String Bypass in geodirsavepost + geodirdeleterevision vulnerability discovered by mak3bread in WordPress Plugin GeoDirectory versions = 2.8.169...
CVE-2026-14549
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...
CVE-2026-14549
The Ray Enterprise Translation WordPress plugin (versions up to 1.7.3) exposes an AJAX action that does not perform capability or nonce checks. This allows any authenticated user, including Subscribers, to add or delete the site’s configured languages. Affected component: WordPress plugin Ray Ent...
CVE-2026-17020 Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure
The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...
EUVD-2026-52599
The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from...