CVE-2026-92924

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

CVE-2026-79618

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

WordPress Unlimited Elements for Elementor plugin < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution vulnerability

Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 2.0.21...

CVE-2026-92924

The Unlimited Elements for Elementor WordPress plugin versions prior to 2.0.21 is vulnerable to arbitrary WordPress shortcode execution. The root cause is a lack of authorization checks when rendering widget output, specifically via the get_addon_output_data function. Depending on the version, th...

EUVD-2026-91215

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

CVE-2026-92924 Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

CVE-2026-85005

The Popup Maker WP WordPress plugin (versions 1.2.2.1 through 1.4.5 ) is vulnerable to a Missing Authorization flaw. The plugin fails to perform adequate authorization checks on several actions, exposing its management page to any authenticated user. This allows users with low-privileged roles, s...

WordPress Popup Maker WP plugin 1.2.2.1-1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation vulnerability

Subscriber+ Zero-Argument PHP Callable Invocation vulnerability discovered by Artus KG in WordPress Plugin Popup Maker WP versions 1.2.2.1-1.4.5...

CVE-2026-85005 Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...

CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

EUVD-2026-91209

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

CVE-2026-79618

The WP User Frontend WordPress plugin, prior to version 4.3.12 , fails to enforce subscription-purchase requirements in one of its post-creation handlers. This Missing Authorization (CWE-862) flaw allows authenticated users with subscriber-level access and above to create and, depending on specif...

CVE-2026-91023

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

EUVD-2026-91194

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

CVE-2026-91023

The Motors WordPress plugin (versions before 1.4.124 ) contains a missing authorization vulnerability (CWE-862 ) involving the stm_make_featured function. The plugin fails to verify if a user is authorized to modify a listing before processing management actions. This allows authenticated attacke...

health-check

health-check Health Check & Troubleshooting daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin...

EUVD-2026-91176

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function, in its registerloginaction='update' flow, trusting an attacker-supplied...

CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page history.pushState'', '', '/'; document.forms0.submit; "success":true,"data":"tempurl":"https://wp-dev.ddev.site?tempaccess=Osn6apJoSJunYNqOhDsn&userid=1","message":"Temporary access URL created successful...

CVE-2024-12558

CVE-2024-12558 WP BASE Booking of Appointments, Services and Events history.pushState'', '', '/'; document.forms0.submit;...

gryffin

ARCHIVED Gryffin beta Gryffin is a large scale web security scanning platform. It is not yet another scanner. It was written to solve two specific problems with existing scanners: coverage and scale. Better coverage translates to fewer false negatives. Inherent scalability translates to capabilit...