14527 matches found
CVE-2026-15142: Improper Privilege Management
The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allowattachmentactions function, which can treat a target user ID as a media attachment ID during user capability...
PT-2026-72879
Name of the Vulnerable Software and Affected Versions Real Estate Manager Pro versions prior to 12.8.7 Description Improper capability handling in the allow attachment actions function allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to...
PT-2026-72153
Name of the Vulnerable Software and Affected Versions Form Maker by 10Web versions prior to 1.15.45 Description An issue exists where authenticated attackers with subscriber-level access or higher can perform blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameter...
WordPress Ecwid by Lightspeed Ecommerce Shopping Cart plugin < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action vulnerability
Subscriber+ Store Disconnection via 'ecdisconnect' Action vulnerability discovered by Alexander Jurkschat in WordPress Plugin Ecwid Shopping Cart versions 7.0.9...
WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls vulnerability
Subscriber+ proSolajaxTablesync and proSolajaxClearlog Calls vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...
WordPress WP Photo Album Plus plugin < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability
Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability discovered by Farid Narimanov in WordPress Plugin WP Photo Album Plus versions 9.2.09.002...
WordPress Events Manager plugin < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection vulnerability
Subscriber+ Booking Consent Record Tampering via SQL Injection vulnerability discovered by Jakub Herman in WordPress Plugin Events Manager versions 7.4.1...
WordPress Form Maker by 10Web plugin < 1.15.45 - Subscriber+ SQL Injection via display_name vulnerability
Subscriber+ SQL Injection via displayname vulnerability discovered by Revanth Meesala in WordPress Plugin Form Maker by 10Web versions 1.15.45...
WordPress Cookie Consent plugin < 0.0.10 - Subscriber+ MaxMind License Key Update vulnerability
Subscriber+ MaxMind License Key Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager versions 0.0.10...
WordPress Cookie Consent plugin < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure vulnerability
Subscriber+ Consent Settings Update and Consent Log Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager versions 0.0.10...
WordPress WP Crowdfunding plugin < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization vulnerability
Subscriber+ Campaign Creation via Missing Authorization vulnerability discovered by Sajjad Haqi in WordPress Plugin WP Crowdfunding versions 2.2.1...
WordPress WP Crowdfunding plugin < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR vulnerability
Subscriber+ Campaign Update Modification via IDOR vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin WP Crowdfunding versions 2.2.1...
CVE-2026-66693
Subscriber Broken Access Control in Motors = 1.4.113 versions...
CVE-2026-66661
Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...
CVE-2026-66658
Subscriber SQL Injection in Reviewer = 3.14.2 versions...
CVE-2026-66654
Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...
CVE-2026-66471
Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...
CVE-2026-66467
Subscriber Cross Site Scripting XSS in FluentCommunity = 2.7.5 versions...