14339 matches found
CVE-2026-77016
The Workeera WordPress plugin (versions before 1.0.6 ) is vulnerable to arbitrary file deletion due to a mass assignment flaw in the candidate profile functionality. The plugin fails to restrict which values can be written to a user's own profile and does not validate or contain the stored file p...
CVE-2026-16569 ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...
CVE-2026-16569
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin, in versions through 0.4.62 , contains an improper access control vulnerability. The plugin fails to verify user permissions before performing stock-update operations via one of its REST endpoint...
WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by TruongLV1 From FPT Night Wolf in WordPress Plugin Mobile App for WooCommerce versions = 0.4.62...
WordPress Mobile App for WooCommerce plugin <= 0.4.69 - Other Vulnerability Type vulnerability
Other Vulnerability Type vulnerability discovered by TruongLV1 From FPT Night Wolf in WordPress Plugin Mobile App for WooCommerce versions = 0.4.69...
CVE-2026-16569 ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...
PT-2026-82467
Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...
CVE-2026-78139: Authorization Bypass Through User-Controlled Key
The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...
PT-2026-82461
Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...
PT-2026-82430
The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...
CVE-2026-32550: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Kadence Shop Kit = 3.0.6 versions...
CVE-2026-32564: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-81279: Missing Authorization
Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...
CVE-2026-81274: Missing Authorization
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
CVE-2026-80433: Missing Authorization
Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...
CVE-2026-78285: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...
CVE-2026-77018: Unrestricted Upload of File with Dangerous Type
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...
CVE-2026-77017: Exposure of Sensitive Information to an Unauthorized Actor
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...
CVE-2026-77016: External Control of File Name or Path
The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...