14590 matches found
PT-2026-68872
Name of the Vulnerable Software and Affected Versions WP Maps versions prior to 4.9.7 Description An issue exists where the plugin fails to perform a capability check in an AJAX action and does not properly validate a user-controlled path used in a file inclusion. This allows users with a...
CVE-2026-14306
The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content...
WordPress < 7.0.3 - Subscriber+ Site Creation vulnerability
Subscriber+ Site Creation vulnerability discovered by Aikido Security in WordPress core versions 7.0.3...
CVE-2026-14306 Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass
The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content...
CVE-2026-14306
CVE-2026-14306 affects Tutor LMS for WordPress, prior to version 3.9.14. The vulnerability is an enrollment check bypass that allows authenticated users with subscriber-level access (or higher) who are enrolled in at least one course to view paid lesson, quiz, and assignment content from other co...
CVE-2026-66711
Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...
CVE-2026-65569
Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...
CVE-2026-65552
Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...
CVE-2026-65554
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions...
CVE-2026-65547
Subscriber SQL Injection in Creative Mail = 1.6.9 versions...
CVE-2026-65543
Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...
CVE-2026-66711
Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...
EUVD-2026-53887
Subscriber Broken Access Control in Frontend Admin by DynamiApps = 3.29.10 versions...
EUVD-2026-53987
Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...
CVE-2026-65569
CVE-2026-65569 affects the WordPress WP Job Portal plugin
CVE-2026-65554 WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions...
EUVD-2026-53982
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions...
EUVD-2026-53980
Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...