14476 matches found
CVE-2026-11565 Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...
PT-2026-78270
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...
CVE-2026-19782: Exposure of Sensitive Information to an Unauthorized Actor
The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...
CVE-2026-66668: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...
CVE-2026-32552: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
PT-2026-78328
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
CVE-2026-18466: Improper Access Control
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...
PT-2026-78332
Name of the Vulnerable Software and Affected Versions Community by PeepSo versions prior to 9.0.5.3 Description An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the...
PT-2026-78306
Name of the Vulnerable Software and Affected Versions WPS Bidouille versions prior to 1.33.5 Description The plugin lacks proper authorization checks in an AJAX action, which allows any authenticated user, including those with subscriber privileges, to retrieve the email addresses of all register...
PT-2026-78288
Name of the Vulnerable Software and Affected Versions SmartCrawl SEO checker, analyzer & optimizer WordPress plugin versions prior to 3.16.3 Description Insufficient capability checks on two AJAX actions allow users with the Subscriber role or higher to read titles of private and draft posts by I...
CVE-2026-16979: Authorization Bypass Through User-Controlled Key
The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names...
WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ SSRF via proSol_url_validate vulnerability
Subscriber+ SSRF via proSolurlvalidate vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...
WordPress WPC Admin Columns plugin < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability
Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WPC Admin Columns versions 2.3.4...
WordPress RT Mega Menu plugin < 1.5.2 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Shivamani Vastrala in WordPress Plugin RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg versions 1.5.2...
WordPress wpForo Forum plugin < 3.1.2 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin wpForo Forum versions 3.1.2...
WordPress WP Directory Kit plugin < 1.5.6 - Subscriber+ SQL Injection via section Parameter vulnerability
Subscriber+ SQL Injection via section Parameter vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions 1.5.6...
CVE-2026-74004
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-73995
Subscriber Broken Authentication in User Registration = 5.2.6 versions...