PT-2026-78984

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

PT-2026-78983

Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...

CVE-2026-74018: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...

PT-2026-78990

Name of the Vulnerable Software and Affected Versions Smart Cleaning versions prior to 4.8.7 Description An arbitrary file upload issue exists that allows users with subscriber privileges to upload unauthorized files to the system. Recommendations Update to a version newer than 4.8.6...

PT-2026-78989

Name of the Vulnerable Software and Affected Versions IT Residence versions prior to 3.2.2 Description An arbitrary file upload issue exists that allows a subscriber to upload unauthorized files to the system. Recommendations Update to a version newer than 3.2.1...

CVE-2026-66668

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

CVE-2026-32552

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

EUVD-2026-62376

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

CVE-2026-66668

CVE-2026-66668 is a Subscriber SQL Injection vulnerability in the Community by PeepSo WordPress plugin, affecting versions ≤ 9.0.5.2 . The vulnerability was discovered by Yukusawa18 and reported via Patchstack. The CVSS 3.1 base score is 8.5 (HIGH) , with a network attack vector, low complexity, ...

CVE-2026-66668 WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

CVE-2026-66668 WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

CVE-2026-32552

A SQL Injection vulnerability exists in the YITH WooCommerce Membership Premium WordPress plugin, affecting versions 2.33.0 and earlier . The flaw is in the Subscriber functionality and was discovered by dutafi . The CVSS 3.1 score is 8.5 (HIGH) , with a network attack vector, low complexity, and...

CVE-2026-32552 WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

CVE-2026-32552 WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

EUVD-2026-62372

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

WordPress Contest Gallery plugin < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts vulnerability

Subscriber+ OpenAI Prompt History Disclosure via postcggetopenaiprompts vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Contest Gallery versions 30.0.7...

WordPress miniOrange 2FA plugin < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send vulnerability

Subscriber+ Arbitrary-Recipient OTP Send vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin miniOrange's Google Authenticator versions 6.2.7...

WordPress Customer Reviews for WooCommerce plugin < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions vulnerability

Subscriber+ Missing Authorization via Multiple Settings AJAX Actions vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Customer Reviews for WooCommerce versions 5.116.0...

CVE-2026-19782

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...

CVE-2026-18466

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...