45 matches found
EUVD-2026-62280
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...
WordPress ShortPixel Adaptive Images plugin <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter vulnerability
Missing Authorization to Authenticated Subscriber+ Third-Party Plugin Option Modification via 'causer' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin ShortPixel Adaptive Images versions = 3.11.5...
EUVD-2026-58863
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-19052
The ProSolution WP Client WordPress plugin (versions before 2.0.9 ) is vulnerable because it fails to perform capability checks on two administrative AJAX actions: proSol_ajaxTablesync and proSol_ajaxClearlog. Because the nonces required for these actions are published on the plugin's public fron...
CVE-2026-18943
The WPC Admin Columns WordPress plugin versions before 2.3.4 is vulnerable to an unauthorized metadata disclosure. Due to a lack of authorisation checks in one of its AJAX actions , users with a role as low as subscriber can read arbitrary user, post, and term metadata. This potentially includes ...
EUVD-2026-57078
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...
CVE-2026-14549 Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...
CVE-2026-14549
The Ray Enterprise Translation WordPress plugin (versions
CVE-2026-12698 wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment
The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activati...
CVE-2026-59541
Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...
EUVD-2026-48194
Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...
PT-2026-63852
Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...
CVE-2026-56010
Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce = 10.4.0 versions...
EUVD-2026-39686
Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce = 10.4.0 versions...
CVE-2026-56010 WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce = 10.4.0 versions...
EUVD-2026-37637
Subscriber Privilege Escalation in JetFormBuilder = 3.6.1 versions...
EUVD-2026-37641
Subscriber Privilege Escalation in Falang multilanguage = 1.4.2 versions...
EUVD-2026-37674
Subscriber Privilege Escalation in MultiLoca = 4.2.15 versions...