14402 matches found
CVE-2026-73402
WP BASE Booking (a WordPress plugin for managing appointments, services, and events) versions ≤ 6.3.2 are affected by a Subscriber Cross-Site Scripting (XSS) vulnerability. The flaw requires low privileges and user interaction , with a changed scope indicating cross-origin impact. CVSS 3.1 base s...
CVE-2026-66677 WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability
Subscriber Broken Authentication in Leyka = 3.32.3 versions...
EUVD-2026-63305
Subscriber Broken Authentication in Leyka = 3.32.3 versions...
CVE-2026-66677
CVE-2026-66677 is a Broken Authentication vulnerability in the WordPress plugin Leyka affecting versions
CVE-2026-66647 WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
CVE-2026-66647 WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
EUVD-2026-63301
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
CVE-2026-66647
CVE-2026-66647 is a Broken Access Control vulnerability in the WordPress Homlisti theme , affecting versions 3.1.2 and below . The flaw allows a user with Subscriber privileges to perform actions beyond their intended access level, resulting in a high integrity impact (CVSS 3.1 score: 6.5 MEDIUM ...
EUVD-2026-63342
Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...
CVE-2026-66601
Subscriber-level authenticated users can inject arbitrary JavaScript into the Media Library Assistant plugin (≤3.39) admin interface, enabling session hijacking or data theft. CVSS 6.5 (MEDIUM). Update to version 3.40 or later; no in-the-wild exploitation reported. See: https://patchstack.com/dat...
CVE-2026-66601 WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...
CVE-2026-66594 WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability
Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...
CVE-2026-66594 WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability
Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...
CVE-2026-66594
The WordPress Persistent Login plugin (versions ≤ 3.1.0) has a subscriber-level SQL injection vulnerability exploitable over the network with low privileges. CVSS 8.5 (HIGH) reflects high confidentiality impact and low availability impact. No in-the-wild exploitation is reported. Upgrade to a ver...
EUVD-2026-63337
Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...
WordPress WP Events Manager plugin < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter vulnerability
Subscriber+ Payment Bypass via 'qty' Parameter vulnerability discovered by Mustafa Ahmed in WordPress Plugin WP Events Manager versions 2.2.5...
WordPress SEO Redirection Plugin - 301 Redirect Manager plugin < 9.19 - Subscriber+ Redirect Rule Disclosure vulnerability
WordPress SEO Redirection Plugin - 301 Redirect Manager plugin 9.19 - Subscriber+ Redirect Rule Disclosure vulnerability discovered by J4ck13Ch4n in WordPress Plugin SEO Redirection versions 9.19...
WordPress WC Buckaroo BPE Gateway plugin < 4.9.0 - Subscriber+ Unauthorized Order Refund vulnerability
Subscriber+ Unauthorized Order Refund vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Buckaroo Woocommerce Payments Plugin versions 4.9.0...
WordPress wpForo Forum plugin < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment vulnerability
Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin wpForo Forum versions 3.1.3...
WordPress Premium Packages - Sell Digital Products Securely plugin < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request vulnerability
WordPress Premium Packages - Sell Digital Products Securely plugin 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request vulnerability discovered by Farid Narimanov in WordPress Plugin WPDM – Premium Packages versions 7.0.7...