CVE-2026-66668

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

CVE-2026-32552

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

EUVD-2026-62376

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

CVE-2026-66668

CVE-2026-66668 is a Subscriber SQL Injection vulnerability in the Community by PeepSo WordPress plugin, affecting versions ≤ 9.0.5.2 . The vulnerability was discovered by Yukusawa18 and reported via Patchstack. The CVSS 3.1 base score is 8.5 (HIGH) , with a network attack vector, low complexity, ...

CVE-2026-66668 WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

CVE-2026-66668 WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

CVE-2026-32552

A SQL Injection vulnerability exists in the YITH WooCommerce Membership Premium WordPress plugin, affecting versions 2.33.0 and earlier . The flaw is in the Subscriber functionality and was discovered by dutafi . The CVSS 3.1 score is 8.5 (HIGH) , with a network attack vector, low complexity, and...

CVE-2026-32552 WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

CVE-2026-32552 WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

EUVD-2026-62372

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

WordPress Contest Gallery plugin < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts vulnerability

Subscriber+ OpenAI Prompt History Disclosure via postcggetopenaiprompts vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Contest Gallery versions 30.0.7...

WordPress miniOrange 2FA plugin < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send vulnerability

Subscriber+ Arbitrary-Recipient OTP Send vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin miniOrange's Google Authenticator versions 6.2.7...

WordPress Customer Reviews for WooCommerce plugin < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions vulnerability

Subscriber+ Missing Authorization via Multiple Settings AJAX Actions vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Customer Reviews for WooCommerce versions 5.116.0...

CVE-2026-19782

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...

CVE-2026-18466

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...

CVE-2026-19782 WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...

EUVD-2026-62292

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...

CVE-2026-19782 WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...

CVE-2026-18466 WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...

EUVD-2026-62280

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...