9964 matches found
EUVD-2026-68776
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders = 4.0.0 versions...
CVE-2026-81280
Print Barcode Labels for your WooCommerce products/orders is a WordPress plugin vulnerable to Sensitive Data Exposure in versions 4.0.0 and below . The vulnerability requires Subscriber-level privileges (low) and can be exploited over the network with low complexity and no user interaction, resul...
CVE-2026-81280 WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders = 4.0.0 versions...
WordPress Support Genix plugin <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token vulnerability
Authenticated Subscriber+ Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Support Genix versions = 1.4.52...
PT-2026-84011
Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...
PT-2026-84016
Subscriber Cross Site Scripting XSS in Kalles Addons = 1.0.6 versions...
CVE-2026-17520
The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails,...
CVE-2026-18234 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...
CVE-2026-16600
CVE-2026-16600 affects the SmartAIPress WordPress plugin through 1.2.0 . The root cause is a missing capability check on the AJAX action smartaipress_openai_upload_and_set_featured_image, combined with the absence of URL validation before a server-side fetch. This allows any user with subscriber-...
CVE-2026-18233
CVE-2026-18233 affects the MStore API WordPress plugin before 4.21.1 . The plugin fails to verify that an order targeted by one of its delivery endpoints actually belongs to the requester. This allows any authenticated user—even those with the lowest Subscriber role—to mark arbitrary orders as co...
EUVD-2026-68043
The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...
CVE-2026-18233 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...
CVE-2026-16600 SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image
The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...
PT-2026-83395
Name of the Vulnerable Software and Affected Versions SmartAIPress versions prior to 1.2.1 Description Users with subscriber-level access and above can perform a full-read Server-Side Request Forgery SSRF, a condition where an attacker forces a server to make requests to an unintended location...
Malicious code in ux-metrics-client-interaction-subscriber (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...
MAL-2026-15545 Malicious code in ux-metrics-client-interaction-subscriber (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...
CVE-2026-81761
Subscriber Broken Access Control in WpEvently = 5.5.0 versions...
CVE-2026-81299
Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...