42 matches found
CVE-2026-107775
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite ...
EUVD-2026-117354
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite ...
CVE-2026-107775
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin (versions before 5.3.3 ) contains a vulnerability where it fails to verify if an acting administrator is authorized to manage specific users. This flaw allows a subsite Administrator on a WordPress Multisite to en...
CVE-2026-114444
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin (versions before 2.191 ) contains a vulnerability where the File System Watcher file viewer lacks proper access controls. Specifically, it does not restrict the viewer to Super Admins or only the files it legitimat...
PT-2026-133285
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...
CVE-2026-114444: Unknown: The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its…
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...
CVE-2026-113673
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...
CVE-2026-113673 GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...
CVE-2026-113673
The GeoDirectory WordPress plugin versions prior to 2.8.194 is vulnerable to Remote Code Execution (RCE) . The root cause is a failure to properly escape administrator-defined text before it is written into a generated PHP file within the plugin's own folder. This flaw allows high-privilege users...
CVE-2026-113673 GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...
CVE-2026-112219
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and...
EUVD-2026-108596
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and...
CVE-2026-110537 Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change th...
CVE-2026-110537 Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change th...
EUVD-2026-108591
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change th...
CVE-2026-110537
The Essential Addons for Elementor WordPress plugin, in versions before 6.8.7 , contains an Incorrect Authorization vulnerability (CWE-863). The plugin fails to verify if an administrator has permission to manage specific user accounts targeted by its login-approval feature , instead only checkin...
PT-2026-121769
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and...
CVE-2026-107128
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own sit...
EUVD-2026-107059
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own sit...
PT-2026-120454
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own sit...