CVE-2026-95525

The WP User Frontend plugin for WordPress, affecting versions

EUVD-2026-85494

Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...

EUVD-2026-85492

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-95523 WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-95523 WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-95523

The WP User Frontend plugin for WordPress, versions

CVE-2026-94679 WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...

EUVD-2026-85484

Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...

CVE-2026-94679

The Fluent Support WordPress plugin, version 2.3.2 and below , is affected by a Broken Access Control vulnerability. This flaw allows for unauthorized actions within the subscriber context. No specific technical root cause, practical consequences, or remediation steps are provided in the availabl...

EUVD-2026-85466

Subscriber Cross Site Scripting XSS in wpForo Forum = 3.1.5 versions...

CVE-2026-93772 WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in wpForo Forum = 3.1.5 versions...

CVE-2026-93772

The wpForo Forum plugin for WordPress, affecting versions

CVE-2026-93772 WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in wpForo Forum = 3.1.5 versions...

WordPress Import and export users and customers plugin <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by khanhnv in WordPress Plugin Import and export users and customers versions = 2.4.17...

CVE-2026-91025

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

CVE-2026-93508

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

CVE-2026-84150

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with...

CVE-2026-84098

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging...

CVE-2026-83555

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

CVE-2026-84046

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses...