14585 matches found
CVE-2026-27535
CVE-2026-27535 affects the WordPress Solace Extra plugin up to version 1.6.0. The vulnerability is described as Broken Access Control, enabling lower-privilege attackers to access restricted functionality. The CVSS 3.1 base score is 7.1 (High), with Network attack vector, Low attack complexity, P...
CVE-2026-14332
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...
CVE-2026-14332 Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...
CVE-2026-14332
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...
CVE-2026-14332 Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...
WordPress LearnPress plugin < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant vulnerability
Subscriber+ Sensitive Information Exposure via AI Assistant vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin LearnPress versions 4.4.4...
WordPress WP Photo Album Plus plugin < 9.2.04.003 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Photo Album Plus versions 9.2.04.003...
WordPress CubeWP Framework plugin <= 1.1.30 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by Louis Deschanel JeanJeanLeHaxor, Pascal SUN in WordPress Plugin CubeWP versions = 1.1.30...
PT-2026-71530
Subscriber Broken Access Control in Travelfic Toolkit = 1.5.1 versions...
PT-2026-71537
Subscriber SQL Injection in WPJAM Basic = 7.0.1 versions...
PT-2026-71550
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...
PT-2026-71498
Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...
PT-2026-71580
Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...
PT-2026-71552
Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...
PT-2026-71556
Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...
PT-2026-71590
Subscriber Broken Access Control in Motors = 1.4.113 versions...
PT-2026-71573
Subscriber Cross Site Scripting XSS in FluentCommunity = 2.7.5 versions...
CVE-2026-28186: Missing Authorization
Subscriber Broken Access Control in Travelfic Toolkit = 1.5.1 versions...