14388 matches found
CVE-2026-32561
CVE-2026-32561 is a Subscriber Privilege Escalation vulnerability in the WordPress Booking Hub plugin, affecting versions 1.3.0 and earlier . The flaw allows a low-privileged Subscriber user to escalate privileges, rated CVSS 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indica...
CVE-2026-32561 WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...
CVE-2026-32561 WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...
CVE-2026-32559
UltimateAI is a WordPress plugin affected by an arbitrary file upload vulnerability in versions ≤ 3.1.0 . A user with Subscriber privilege level can upload arbitrary files without user interaction, with a scope change that allows full compromise of confidentiality, integrity, and availability (CV...
CVE-2026-32560 WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...
CVE-2026-32559 WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...
CVE-2026-32560 WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...
CVE-2026-32560
MagicAI for WordPress (AI Text, Image, Chat, Code, and Voice Generator) plugin versions ≤ 1.4 are affected by a Local File Inclusion (LFI) vulnerability accessible to authenticated users with the Subscriber role. The vulnerability is rated CVSS 8.8 (HIGH) by Patchstack, with a network attack vect...
CVE-2026-32559 WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...
CVE-2026-27364 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability
Subscriber Broken Access Control in Style Kits = 2.6.5 versions...
CVE-2026-27364 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability
Subscriber Broken Access Control in Style Kits = 2.6.5 versions...
CVE-2026-27364
Broken Access Control vulnerability in the WordPress Style Kits plugin (AnalogWP) versions ≤ 2.6.5 . A Subscriber -level authenticated user can exploit insufficient access controls, resulting in a high impact on integrity (CVSS 3.1: 6.5 MEDIUM, vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). No conf...
CVE-2026-78272
Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...
CVE-2026-78277
Subscriber Server Side Request Forgery SSRF in FluentCRM Pro = 3.1.12 versions...
CVE-2026-78278
Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-32478
Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...
CVE-2026-28190
Subscriber Broken Access Control in ProLancer Element = 1.4.8 versions...
CVE-2026-32471
Subscriber SQL Injection in ProLancer Element = 1.4.8 versions...
CVE-2026-32478
CVE-2026-32478 is a Subscriber-level SQL Injection vulnerability in the WP Project Manager Pro WordPress plugin (versions ≤ 4.0.1 ), discovered by researcher dutafi . The flaw allows a user with the low-privilege Subscriber role to execute arbitrary SQL queries, resulting in high confidentiality ...