282 matches found
CVE-2026-78272
Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...
CVE-2026-32478
Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...
EUVD-2026-64798
Subscriber Broken Access Control in ProLancer Element = 1.4.8 versions...
CVE-2026-28190 WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability
Subscriber Broken Access Control in ProLancer Element = 1.4.8 versions...
WordPress SmartCrawl plugin < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability
Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability discovered by Ezekiel Victor in WordPress Plugin SmartCrawl versions 3.16.3...
CVE-2026-74016
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-73998
Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...
CVE-2026-66594
Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...
CVE-2026-74018
CVE-2026-74018 is an Arbitrary File Upload vulnerability in the WordPress Theme Warehouse Cargo (versions ≤ 2.6.9 ). The vulnerability is accessible to users with Subscriber privileges and carries a CVSS 3.1 score of 9.9 (Critical) , with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicatin...
EUVD-2026-63318
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...
EUVD-2026-63317
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
EUVD-2026-63316
Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...
CVE-2026-74016
The WordPress Smart Cleaning theme (≤4.8.6) allows any logged-in subscriber to upload arbitrary files, enabling remote code execution. Patchstack reports this as critical (CVSS 9.9) with a fix available in newer theme versions; upgrading the theme is the primary mitigation. No in-the-wild exploit...
CVE-2026-74014
A Subscriber (low-privileged WordPress user) in the IT Residence theme
CVE-2026-74016 WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-73998
The WordPress WP w3all phpBB plugin (≤ 3.0.5) has a SQL injection vulnerability exploitable by authenticated subscribers with network access; no patch version or in-the-wild exploitation details are provided in the documents.
EUVD-2026-63313
Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...
CVE-2026-73992 WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability
Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...
CVE-2026-73992
The WordPress Query Wrangler plugin (versions ≤ 1.5.57) allows authenticated subscribers to execute arbitrary code remotely, yielding full server compromise (CVSS 9.9 Critical, network-exploitable with low complexity). No in-the-wild exploitation or patch version is documented in the provided sou...