336 matches found
WordPress GeoDirectory plugin <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision vulnerability
Authenticated Subscriber+ Arbitrary File Deletion via 'posttype' Parameter via Query-String Bypass in geodirsavepost + geodirdeleterevision vulnerability discovered by mak3bread in WordPress Plugin GeoDirectory versions = 2.8.169...
CVE-2026-14549 Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...
CVE-2026-14549
The Ray Enterprise Translation WordPress plugin affects versions through 1.7.3 (or prior to 1.7.4) due to a lack of capability or nonce checks on one of its AJAX actions. This security flaw allows any authenticated user, including those with the lowest Subscriber privileges, to unauthorizedly add...
CVE-2026-14549
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...
WordPress AI Engine path traversal vulnerability
WordPress AI Engine is a core component of the official WordPress plugin library developed by developer JordyMeow. Its purpose is to integrate multi-model AI capabilities chatbots, content generation, MCP smart agents, etc. natively into the WordPress backend, allowing for easy invocation of...
CVE-2026-17020 Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure
The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...
CVE-2026-16955 AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...
CVE-2026-16590 WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users...
PT-2026-69184
Name of the Vulnerable Software and Affected Versions AI Engine versions prior to 3.6.6 Description An issue exists where the software fails to confine a caller-supplied file path before reading it and forwarding the contents to an external service. This allows users with a subscriber-level accou...
WordPress Accelerate theme <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation vulnerability
Missing Authorization to Authenticated Subscriber+ ThemeGrill Demo Importer Plugin Installation vulnerability discovered by Dmitrii Ignatyev in WordPress Theme Accelerate versions = 1.5.3...
EUVD-2026-52599
The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from...
CVE-2026-12698 wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment
The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activati...
PT-2026-67663
The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from...
CVE-2026-12697 wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user...
CVE-2026-50737
When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the apply worker runs at a privilege level equivalent to a PostgreSQL superuser in default installations, any function invoked by...
CVE-2026-59541
Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...
EUVD-2026-48194
Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...
CVE-2026-59542 WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability
Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...