14340 matches found
EUVD-2026-66291
The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...
CVE-2026-77757 Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...
CVE-2026-77757
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin (versions 8.5-8.9.2 ) is vulnerable to an arbitrary image move flaw. The root cause is a failure to sanitize user-supplied image references when used as a source for a file move operation, specifically duri...
EUVD-2026-66287
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...
CVE-2026-75797 AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter
The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and...
CVE-2026-74930 WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email...
CVE-2026-75797
The AI Engine WordPress plugin (versions 3.3.3-3.7.2 ) contains an arbitrary file read vulnerability. The flaw exists because the plugin fails to confine caller-supplied URLs when mapping them to local filesystem paths before reading files and forwarding contents to an external service. This allo...
CVE-2026-75797 AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter
The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and...
CVE-2026-74929
The Project Manager WordPress plugin, in versions before 4.0.7 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to restrict several REST API routes to the specific projects a user is authorized to access. This oversight allows any authenticated user, suc...
EUVD-2026-66281
The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and...
CVE-2026-77757: Improper Limitation of a Pathname to a Restricted Directory
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...
CVE-2026-75797: Improper Limitation of a Pathname to a Restricted Directory
The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and...
CVE-2026-74929: Improper Access Control
The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...
PT-2026-81971
The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...
PT-2026-81967
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...
WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin FundEngine versions = 1.8.1...
WordPress MStore API plugin < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR vulnerability
Subscriber+ Order and Customer PII Disclosure via IDOR vulnerability discovered by Sai Praneeth Koti in WordPress Plugin MStore API versions 4.21.0...
WordPress Geo My WP plugin < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR vulnerability
Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin GEO my WordPress versions 4.5.5.3...
WordPress RealHomes Memberships plugin < 3.1.0 - Subscriber+ Membership Payment Bypass vulnerability
Subscriber+ Membership Payment Bypass vulnerability discovered by Pablo González and Fran Ramírez in WordPress Plugin RealHomes Memberships versions 3.1.0...
WordPress AutomatorWP plugin <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action vulnerability
Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure via automatorwpconvertkitgetforms AJAX Action vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin AutomatorWP versions = 5.8.4...