EUVD-2026-60890

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

PT-2026-77123

Subscriber Broken Authentication in User Registration = 5.2.6 versions...

PT-2026-77127

Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...

PT-2026-77121

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

PT-2026-77079

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

WordPress Cookie Banner for GDPR / CCPA plugin <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.5...

WordPress Ecwid by Lightspeed Ecommerce Shopping Cart plugin < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action vulnerability

Subscriber+ Store Disconnection via 'ecdisconnect' Action vulnerability discovered by Alexander Jurkschat in WordPress Plugin Ecwid Shopping Cart versions 7.0.9...

WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls vulnerability

Subscriber+ proSolajaxTablesync and proSolajaxClearlog Calls vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...

WordPress Events Manager plugin < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection vulnerability

Subscriber+ Booking Consent Record Tampering via SQL Injection vulnerability discovered by Jakub Herman in WordPress Plugin Events Manager versions 7.4.1...

WordPress Cookie Consent plugin < 0.0.10 - Subscriber+ MaxMind License Key Update vulnerability

Subscriber+ MaxMind License Key Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager versions 0.0.10...

CVE-2026-66661

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

CVE-2026-66456

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

CVE-2026-28168

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

CVE-2026-28159

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-66693 WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability

Subscriber Broken Access Control in Motors = 1.4.113 versions...

EUVD-2026-57899

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

CVE-2026-66661 WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

CVE-2026-66658

Subscriber SQL Injection in Reviewer = 3.14.2 versions...

CVE-2026-66471

Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...

CVE-2026-66467

CVE-2026-66467 affects the WordPress FluentCommunity plugin (versions &lt;= 2.7.5). The connected records confirm a Cross Site Scripting (XSS) vulnerability in the Subscriber context. The CVE entry lists CVSS v3.1 metrics with a base score of 6.5 (Medium) and attributes: Network attack vector, Lo...