MAL-2026-15545 Malicious code in ux-metrics-client-interaction-subscriber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...

CVE-2026-81761

Subscriber Broken Access Control in WpEvently = 5.5.0 versions...

CVE-2026-81299

Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...

EUVD-2026-67733

Subscriber Broken Access Control in WpEvently = 5.5.0 versions...

CVE-2026-81761 WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in WpEvently = 5.5.0 versions...

CVE-2026-81761

WpEvently is a WordPress plugin affected by a Broken Access Control vulnerability in versions ≤ 5.5.0 . The flaw allows a Subscriber -level user to perform actions beyond their intended permissions, resulting in a low confidentiality impact with no integrity or availability loss. The CVSS 3.1 sco...

CVE-2026-81299

CVE-2026-81299 affects the WordPress WP Job Portal plugin, versions

EUVD-2026-67729

Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...

CVE-2026-81299 WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...

CVE-2026-81299 WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...

WordPress All-in-One WP Migration Unlimited Extension plugin <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'ai1wmbackupspath' Parameter vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin All-in-One WP Migration Unlimited Extension versions = 2.84...

WordPress TranslatePress plugin <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via Approved Comment Body in Translation Editor vulnerability discovered by momopon1415 in WordPress Plugin TranslatePress versions = 3.2.6...

WordPress Simple Membership plugin < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name vulnerability

Unauthenticated Stored XSS via PayPal Subscription Subscriber Name vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Simple Membership versions 4.7.8...

WordPress WP Maps plugin < 4.9.7 - Subscriber+ Local File Inclusion vulnerability

Subscriber+ Local File Inclusion vulnerability discovered by Jakub Herman in WordPress Plugin WP Maps versions 4.9.7...

WordPress Content Views plugin < 4.5 - Subscriber+ SQL Injection via preview_request vulnerability

Subscriber+ SQL Injection via previewrequest vulnerability discovered by Jakub Herman in WordPress Plugin Content Views versions 4.5...

WordPress Library Management System plugin < 3.6.7 - Subscriber+ SQL Injection via Filter Value vulnerability

Subscriber+ SQL Injection via Filter Value vulnerability discovered by João Ramos Maciel in WordPress Plugin Library Management System versions 3.6.7...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin 8.5-8.9.2 - Subscriber+ Arbitrary Image Move vulnerability

Subscriber+ Arbitrary Image Move vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Directorist versions 8.5-8.9.2...

WordPress Bit File Manager plugin < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch vulnerability

Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch vulnerability discovered by Artus KG in WordPress Plugin Bit File Manager versions 6.9.1...

CVE-2026-6128

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...

CVE-2026-79995

The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email...