14638 matches found
PT-2026-64229
The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plus name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, ...
CVE-2026-12689: Missing Authorization
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' priva...
CVE-2026-12690: Missing Authorization
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license setting...
PT-2026-64239
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' priva...
K000162387: PostgreSQL vulnerability CVE-2026-6476
Security Advisory Description SQL injection in PostgreSQL pgcreatesubscriber allows an attacker with pgcreatesubscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pgcreatesubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18...
CVE-2026-65530
Subscriber Broken Access Control in TemplateSpare = 4.2.2 versions...
CVE-2026-65491
Subscriber Broken Access Control in Query Wrangler = 1.5.57 versions...
CVE-2026-65493
Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...
CVE-2026-65478
Subscriber Broken Access Control in ListingPro = 2.9.10 versions...
CVE-2026-65479
Subscriber Broken Access Control in Reviewer = 3.14.2 versions...
CVE-2026-65463
Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...
CVE-2026-61973
Subscriber Broken Access Control in ShopLentor Pro = 2.8.5 versions...
CVE-2026-59542
Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...
CVE-2026-59543
Subscriber Remote Code Execution RCE in Advanced Views = 3.8.11 versions...
CVE-2026-59522
Subscriber Broken Access Control in WP ERP = 1.17.5 versions...
CVE-2026-59541
Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...
CVE-2026-59513
Subscriber Cross Site Scripting XSS in Masteriyo - LMS = 2.3.0 versions...
CVE-2026-57808
Subscriber Arbitrary Content Deletion in WP EasyPay = 4.5.0 versions...