14526 matches found
CVE-2026-32466
The Gravity Forms Bookings premium WordPress plugin (versions ≤ 2.1) contains a SQL injection flaw exploitable by authenticated subscribers. CVSS 8.5 (HIGH) reflects network access with low privileges. Patchstack reports it; no in-the-wild exploitation or patch version details are provided in the...
CVE-2026-28191 WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...
EUVD-2026-60890
Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...
CVE-2026-28191 WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...
CVE-2026-28191
A privilege escalation vulnerability affects the WordPress plugin The Grid (versions
CVE-2026-28191
Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...
WordPress Kirki plugin <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter vulnerability
Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure via 'context' Parameter vulnerability discovered by Datist Pham - NAB Innovation Centre Vietnam in WordPress Plugin Kirki versions = 6.1.1...
WordPress ShortPixel Adaptive Images plugin <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter vulnerability
Missing Authorization to Authenticated Subscriber+ Third-Party Plugin Option Modification via 'causer' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin ShortPixel Adaptive Images versions = 3.11.5...
WordPress Query Wrangler plugin <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter vulnerability
Authenticated Subscriber+ Remote Code Execution via 'options' Parameter vulnerability discovered by Enis - TURKOL YAZILIM in WordPress Plugin Query Wrangler versions = 1.5.57...
WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content plugin <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field vulnerability
Authenticated Subscriber+ Arbitrary Shortcode Execution via First Name / Last Name Profile Field vulnerability discovered by WordFence in WordPress Plugin ProfilePress versions = 4.16.19...
WordPress Real Estate Manager Pro plugin <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision vulnerability
Authenticated Subscriber+ Privilege Escalation via 'userhascap' Filter ID Collision vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin Real Estate Manager Pro versions = 12.8.6...
CVE-2026-68568: Incorrect Privilege Assignment
Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...
PT-2026-77062
Name of the Vulnerable Software and Affected Versions Modal Survey versions prior to 2.0.2.2.4 Description An Insecure Direct Object Reference IDOR exists, which occurs when an application provides direct access to objects based on user-supplied input, potentially allowing unauthorized access to...
CVE-2026-66634: Authorization Bypass Through User-Controlled Key
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
PT-2026-77082
Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...
PT-2026-77116
Name of the Vulnerable Software and Affected Versions MWB HubSpot for WooCommerce versions prior to 1.6.8 Description The software contains a broken authentication mechanism that allows users with Subscriber privileges to bypass authentication requirements. Recommendations Update MWB HubSpot for...
CVE-2026-73995: Authentication Bypass by Spoofing
Subscriber Broken Authentication in User Registration = 5.2.6 versions...
PT-2026-77127
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...