PT-2026-71546

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

PT-2026-71519

Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...

PT-2026-71563

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

PT-2026-71557

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

PT-2026-71586

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

PT-2026-71518

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

PT-2026-71520

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

CVE-2026-18943

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators...

EUVD-2026-57103

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators...

CVE-2026-14857

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

EUVD-2026-57072

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

PT-2026-71029

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

PT-2026-71028

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators...

WordPress Ray Enterprise Translation plugin <= 1.7.3 - Subscriber+ Language Addition and Deletion vulnerability

Subscriber+ Language Addition and Deletion vulnerability discovered by Akshat Parikh in WordPress Plugin Ray Enterprise Translation versions = 1.7.3...

EUVD-2026-55029

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password...

CVE-2026-18666 Library Management System < 3.6.7 - Subscriber+ SQL Injection via Filter Value

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password...

CVE-2026-18666 Library Management System < 3.6.7 - Subscriber+ SQL Injection via Filter Value

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password...

CVE-2026-17542

The CVE concerns the File Manager WordPress plugin before 6.9.1. One of its file manager connector endpoints lacks a capability check, allowing any authenticated user (e.g., a subscriber) to browse the entire WordPress installation directory and download files of certain types (archives and docum...

EUVD-2026-52586

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's...

EUVD-2026-51942

The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds...