CVE-2026-81783

CVE-2026-81783 affects the WordPress plugin MailMunch – Grow your Email List , versions ≤ 3.2.5 . The vulnerability is a Broken Authentication flaw exploitable by users with the Subscriber role. Discovered by Jakub Herman , it carries a CVSS 3.1 score of 7.1 (HIGH) with the vector AV:N/AC:L/PR:L/...

EUVD-2026-75516

Subscriber Broken Authentication in MailMunch – Grow your Email List = 3.2.5 versions...

CVE-2026-81783 WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability

Subscriber Broken Authentication in MailMunch – Grow your Email List = 3.2.5 versions...

CVE-2026-81782

WordPress WP Docs plugin versions up to 2.3.1 contain a Cross-Site Scripting (XSS) vulnerability accessible to Subscriber-level users. The CVSS v3.1 score is 6.5 (Medium) , with a network attack vector, low complexity, required user interaction, and a changed scope resulting in low impact on conf...

CVE-2026-81782 WordPress WP Docs plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...

CVE-2026-81782 WordPress WP Docs plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...

EUVD-2026-75515

Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...

CVE-2026-81275 WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

CVE-2026-81275 WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

EUVD-2026-75514

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

CVE-2026-81275

The WordPress Youzify plugin (versions

CVE-2026-88871 WWBN AVideo CustomizeUser setSubscribers CSRF via GET

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads usersid and ExtraSubscribers from $REQUEST and calls...

EUVD-2026-75421

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads usersid and ExtraSubscribers from $REQUEST and calls...

WordPress Redux Framework plugin <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Redux Framework versions = 4.5.13.1...

CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-5399

The Redux Framework WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the Slider field in User Profile settings in versions up to and including 4.5.13.1 . The root cause involves three factors: insufficient input sanitization in the user_meta_save() function (which only sani...

WordPress Payment Plugins for PayPal WooCommerce plugin < 2.0.26 - Subscriber+ Stored Payment Method Assignment vulnerability

Subscriber+ Stored Payment Method Assignment vulnerability discovered by m1w34p0n & krypt3d in WordPress Plugin Payment Plugins for PayPal WooCommerce versions 2.0.26...

WordPress WP Business Intelligence Lite plugin <= 3.2.0 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation vulnerability

Authenticated Subscriber+ Missing Authorization to Privilege Escalation vulnerability discovered by Nabil Irawan in WordPress Plugin Business Intelligence Lite versions = 3.2.0...

WordPress Bulk Password Reset plugin <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset vulnerability

Authenticated Subscriber+ Arbitrary Password Reset vulnerability discovered by Afan, moonge in WordPress Plugin Bulk Password Reset versions = 1.3.3...