242 matches found
CVE-2026-28191
Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...
CVE-2026-74004
The WordPress plugin "Gravity Booster – Styles & Layouts for Gravity Forms" (versions ≤ 6.0) has a broken access control flaw exploitable by authenticated subscribers, allowing unauthorized access to plugin functions. CVSS 3.1 score is 5.4 (MEDIUM) with network attack vector, low privileges requi...
EUVD-2026-60809
Subscriber Broken Authentication in User Registration = 5.2.6 versions...
CVE-2026-73995 WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability
Subscriber Broken Authentication in User Registration = 5.2.6 versions...
CVE-2026-73404
Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...
EUVD-2026-60802
Subscriber Broken Authentication in MWB HubSpot for WooCommerce = 1.6.7 versions...
CVE-2026-73189
The WordPress WP Crowdfunding plugin (versions below 2.2.1) has an IDOR vulnerability allowing authenticated subscribers to access other users' data via direct object references. Patchstack reports a CVSS 6.5 (MEDIUM) with HIGH confidentiality impact. Exploitation in the wild is not documented; u...
CVE-2026-66634
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
CVE-2026-32466
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-28191
Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...
EUVD-2026-60890
Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...
WordPress Cookie Banner for GDPR / CCPA plugin <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.5...
WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls vulnerability
Subscriber+ proSolajaxTablesync and proSolajaxClearlog Calls vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...
CVE-2026-66661
Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...
CVE-2026-66456
Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...
CVE-2026-28168
Subscriber SQL Injection in CubeWP = 1.1.30 versions...
CVE-2026-28159
Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...
CVE-2026-66693 WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability
Subscriber Broken Access Control in Motors = 1.4.113 versions...