268 matches found
PT-2026-78270
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...
CVE-2026-74004
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-73396
Subscriber Broken Authentication in MWB HubSpot for WooCommerce = 1.6.7 versions...
CVE-2026-73359
Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...
CVE-2026-28191
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...
CVE-2026-74004
The WordPress plugin "Gravity Booster – Styles & Layouts for Gravity Forms" (versions ≤ 6.0) has a broken access control flaw exploitable by authenticated subscribers, allowing unauthorized access to plugin functions. CVSS 3.1 score is 5.4 (MEDIUM) with network attack vector, low privileges requi...
CVE-2026-73995 WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability
Subscriber Broken Authentication in User Registration = 5.2.6 versions...
EUVD-2026-60809
Subscriber Broken Authentication in User Registration = 5.2.6 versions...
CVE-2026-73404
Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...
EUVD-2026-60802
Subscriber Broken Authentication in MWB HubSpot for WooCommerce = 1.6.7 versions...
CVE-2026-73189
The WP Crowdfunding WordPress plugin (versions
CVE-2026-66634
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
CVE-2026-32466
Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...
CVE-2026-28191
Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...
EUVD-2026-60890
Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...
PT-2026-77127
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
WordPress Cookie Banner for GDPR / CCPA plugin <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.5...
WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls vulnerability
Subscriber+ proSolajaxTablesync and proSolajaxClearlog Calls vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...