14402 matches found
CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...
CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...
CVE-2026-76057: Missing Authorization
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-76074: Missing Authorization
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-19883: Improper Privilege Management
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...
WordPress SmartCrawl plugin < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability
Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability discovered by Ezekiel Victor in WordPress Plugin SmartCrawl versions 3.16.3...
CVE-2026-74016
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-74013
Subscriber SQL Injection in eShipper Commerce = 2.16.13 versions...
CVE-2026-74014
Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...
CVE-2026-74018
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...
CVE-2026-73402
Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...
CVE-2026-73992
Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...
CVE-2026-73998
Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...
CVE-2026-66677
Subscriber Broken Authentication in Leyka = 3.32.3 versions...
CVE-2026-66647
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
CVE-2026-66601
Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...
CVE-2026-66594
Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...
EUVD-2026-63318
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...
CVE-2026-74018
CVE-2026-74018 is an Arbitrary File Upload vulnerability in the WordPress Theme Warehouse Cargo (versions ≤ 2.6.9 ). The vulnerability is accessible to users with Subscriber privileges and carries a CVSS 3.1 score of 9.9 (Critical) , with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicatin...
