14277 matches found
CVE-2026-87888 YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
WordPress Sprout Invoices plugin < 20.8.16 - Subscriber+ Private Note Overwrite vulnerability
Subscriber+ Private Note Overwrite vulnerability discovered by Usama Arshad in WordPress Plugin Client Invoicing by Sprout Invoices versions 20.8.16...
EUVD-2026-76801
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
CVE-2026-77005 Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal
The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can...
CVE-2026-77005
The CODE MONKEYS PROPOSALS WordPress plugin (versions
CVE-2026-77161: Improper Neutralization of Special Elements used in an SQL Command
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-87759: Improper Privilege Management
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...
CVE-2026-85198: Improper Neutralization of Special Elements used in an SQL Command
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-87888: Improper Neutralization of Input During Web Page Generation
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
CVE-2026-15451: Improper Privilege Management
The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'addsubaccountuser' function that passes the raw 'userdata' array to 'wpinsertuser' without filtering...
PT-2026-90585
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
PT-2026-90599
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-77006: External Control of File Name or Path
The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the...
CVE-2026-62132
Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...
CVE-2026-62133
Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...
CVE-2026-62102
Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...
CVE-2026-62106
Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...
WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution vulnerability
Authenticated Subscriber+ PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin Tutor LMS versions = 4.0.7...