14298 matches found
EUVD-2026-70912
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.9 - Subscriber+ Arbitrary Post Meta Write vulnerability
Subscriber+ Arbitrary Post Meta Write vulnerability discovered by ryan zegar in WordPress Plugin Directorist versions 8.9...
CVE-2026-84066 Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
CVE-2026-84066 Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
CVE-2026-16281 Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...
EUVD-2026-70900
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...
CVE-2026-16281 Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...
PT-2026-85423
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
CVE-2026-84066: Missing Authorization
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
CVE-2026-84836
Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...
CVE-2026-84814
Subscriber Privilege Escalation in Bricksforge = 3.1.8.8 versions...
CVE-2026-84779
Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...
CVE-2026-84756
Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...
CVE-2026-81282
Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...
CVE-2026-81281
Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...
CVE-2026-84836 WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...
CVE-2026-84836 WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...
CVE-2026-84836
WC Ukraine Shipping is a WordPress plugin affected by an Insecure Direct Object References (IDOR) vulnerability in versions 1.22.3 and earlier . The flaw allows a low-privilege user (Subscriber level) to access restricted objects, resulting in high confidentiality impact and low integrity impact,...