CVE-2026-87828

The Seraphinite Accelerator WordPress plugin (versions before 2.29.24 ) is vulnerable to a denial of service (DoS) attack due to a missing capability check on a state-update AJAX action. This flaw allows authenticated users, such as subscribers , to submit a malformed value that triggers an uncau...

CVE-2026-85572

The Tutor LMS WordPress plugin, in versions 4.0.0 through 4.0.7 , contains a vulnerability where it fails to verify if a user has authorized access to a course before returning its lesson discussion content . This flaw allows any authenticated user , such as a subscriber, to read comments from co...

CVE-2026-85349 FluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing the...

CVE-2026-85572 Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation...

EUVD-2026-80195

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing the...

WordPress Tutor LMS plugin 4.0.0-4.0.7 - Subscriber+ Cross-Course Lesson Comment Disclosure vulnerability

Subscriber+ Cross-Course Lesson Comment Disclosure vulnerability discovered by Shirshak in WordPress Plugin Tutor LMS versions 4.0.0-4.0.7...

CVE-2026-74926 MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

CVE-2026-74926 MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

EUVD-2026-80174

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

CVE-2026-74926

The MultiVendorX WordPress plugin (versions 5.0.0-5.0.15 ) is vulnerable to an authorization flaw because it fails to verify if a user owns the store they are attempting to modify via a REST API route . This allows any authenticated user, including those with subscriber privileges, to overwrite s...

CVE-2026-87959: Improper Access Control

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

CVE-2026-86823: URL Redirection to Untrusted Site

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...

PT-2026-94080

Name of the Vulnerable Software and Affected Versions phpList versions prior to 3.6.17 Description The mass subscriber removal form handler fails to validate cross-site request forgery CSRF tokens. CSRF is a type of attack that tricks a victim into submitting a malicious request. This allows...

CVE-2026-78088: Unrestricted Upload of File with Dangerous Type

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

CVE-2026-85349: Exposure of Sensitive Information to an Unauthorized Actor

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing the...

PT-2026-93313

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

CVE-2026-92806: Cross-Site Request Forgery (CSRF)

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...

CVE-2026-87828: Uncontrolled Resource Consumption

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.0.0 - Authenticated (Subscriber+) Username Enumeration vulnerability

Authenticated Subscriber+ Username Enumeration vulnerability discovered by Choriyev Qahramon in WordPress Plugin Blog2Social versions = 9.0.0...

CVE-2026-14805

The Consulting WordPress theme (Consulting – Business, Finance WordPress Theme) is affected by an authenticated privilege escalation in versions up to and including 6.7.16 . Two combined flaws enable the attack: the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/cla...