CVE-2026-73998

Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...

CVE-2026-66594

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

CVE-2026-74018

CVE-2026-74018 is an Arbitrary File Upload vulnerability in the WordPress Theme Warehouse Cargo (versions ≤ 2.6.9 ). The vulnerability is accessible to users with Subscriber privileges and carries a CVSS 3.1 score of 9.9 (Critical) , with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicatin...

EUVD-2026-63318

Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...

EUVD-2026-63317

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

EUVD-2026-63316

Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...

CVE-2026-74014

A Subscriber (low-privileged WordPress user) in the IT Residence theme

CVE-2026-74016 WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

CVE-2026-74016

The WordPress Smart Cleaning theme (≤4.8.6) allows any logged-in subscriber to upload arbitrary files, enabling remote code execution. Patchstack reports this as critical (CVSS 9.9) with a fix available in newer theme versions; upgrading the theme is the primary mitigation. No in-the-wild exploit...

CVE-2026-73998

The WordPress WP w3all phpBB plugin (≤ 3.0.5) has a SQL injection vulnerability exploitable by authenticated subscribers with network access; no patch version or in-the-wild exploitation details are provided in the documents.

EUVD-2026-63313

Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...

CVE-2026-73992 WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

CVE-2026-73992

The WordPress Query Wrangler plugin (versions ≤ 1.5.57) allows authenticated subscribers to execute arbitrary code remotely, yielding full server compromise (CVSS 9.9 Critical, network-exploitable with low complexity). No in-the-wild exploitation or patch version is documented in the provided sou...

EUVD-2026-63311

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

EUVD-2026-63310

Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...

EUVD-2026-63305

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

CVE-2026-66677 WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

EUVD-2026-63301

Subscriber Broken Access Control in Homlisti = 3.1.2 versions...

CVE-2026-66594

The WordPress Persistent Login plugin (versions ≤ 3.1.0) has a subscriber-level SQL injection vulnerability exploitable over the network with low privileges. CVSS 8.5 (HIGH) reflects high confidentiality impact and low availability impact. No in-the-wild exploitation is reported. Upgrade to a ver...

PT-2026-78990

Name of the Vulnerable Software and Affected Versions Smart Cleaning versions prior to 4.8.7 Description An arbitrary file upload issue exists that allows users with subscriber privileges to upload unauthorized files to the system. Recommendations Update to a version newer than 4.8.6...