CVE-2026-85005

The Popup Maker WP WordPress plugin (versions 1.2.2.1 through 1.4.5 ) is vulnerable to a Missing Authorization flaw. The plugin fails to perform adequate authorization checks on several actions, exposing its management page to any authenticated user. This allows users with low-privileged roles, s...

WordPress Popup Maker WP plugin 1.2.2.1-1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation vulnerability

Subscriber+ Zero-Argument PHP Callable Invocation vulnerability discovered by Artus KG in WordPress Plugin Popup Maker WP versions 1.2.2.1-1.4.5...

CVE-2026-85005 Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...

CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

EUVD-2026-91209

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

CVE-2026-79618

The WP User Frontend WordPress plugin, prior to version 4.3.12 , fails to enforce subscription-purchase requirements in one of its post-creation handlers. This Missing Authorization (CWE-862) flaw allows authenticated users with subscriber-level access and above to create and, depending on specif...

CVE-2026-91023

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

EUVD-2026-91194

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

CVE-2026-91023

The Motors WordPress plugin (versions before 1.4.124 ) contains a missing authorization vulnerability (CWE-862 ) involving the stm_make_featured function. The plugin fails to verify if a user is authorized to modify a listing before processing management actions. This allows authenticated attacke...

health-check

health-check Health Check & Troubleshooting daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin...

EUVD-2026-91176

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function, in its registerloginaction='update' flow, trusting an attacker-supplied...

CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page history.pushState'', '', '/'; document.forms0.submit; "success":true,"data":"tempurl":"https://wp-dev.ddev.site?temp...

CVE-2024-12558

CVE-2024-12558 WP BASE Booking of Appointments, Services and Events history.pushState'', '', '/'; document.forms0.submit;...

gryffin

ARCHIVED Gryffin beta Gryffin is a large scale web security scanning platform. It is not yet another scanner. It was written to solve two specific problems with existing scanners: coverage and scale. Better coverage translates to fewer false negatives. Inherent scalability translates to capabilit...

CVE-2025-15260

CVE-2025-15260 : Autorisation manquante / Contrôle d'accès brisé dans le plugin MyRewards – Points de fidélité et récompenses pour WooCommerce Avertissement : Ce dépôt est créé à des fins éducatives et de divulgation éthique uniquement. La vulnérabilité a été signalée de manière responsable au...

PT-2026-104149

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

PT-2026-104114

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

PT-2026-104108

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

PT-2026-104090

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

PT-2026-104118

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otter form widget filter' parameter. This makes it possible for authenticated attackers, with...