4287 matches found
CVE-2026-27364: Missing Authorization
Subscriber Broken Access Control in Style Kits = 2.6.5 versions...
CVE-2026-32478: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...
CVE-2026-78272: Missing Authorization
Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...
CVE-2026-78266: Missing Authorization
Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...
CVE-2026-14853: Missing Authorization
The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...
CVE-2026-18027: Improper Limitation of a Pathname to a Restricted Directory
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the getimagesrcinbase64 function. This makes it possible for authenticated attackers, with...
CVE-2026-16149: Improper Privilege Management
The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...
CVE-2026-19883: Improper Privilege Management
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...
CVE-2026-76057: Missing Authorization
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-76074: Missing Authorization
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-66594: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...
CVE-2026-74013: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...
CVE-2026-66647: Missing Authorization
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
CVE-2026-73992: Improper Control of Generation of Code
Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...
CVE-2026-73998: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...
CVE-2026-66668
Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...
CVE-2026-32552: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
CVE-2026-19782: Exposure of Sensitive Information to an Unauthorized Actor
The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...