CVE-2026-14444

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-14444 WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

EUVD-2026-72403

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-14444 WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-14444

CVE-2026-14444 is a Privilege Escalation vulnerability in the WP Fusion (Pro) WordPress plugin, affecting all versions up to and including 3.47.13 . The root cause is insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. Authenticate...

WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Hide My WP Ghost versions = 7.0.09...

WordPress WP Fusion (Pro) plugin <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via ThriveCart Auto Login 'role' Parameter vulnerability discovered by Jarno Vos jarnovos in WordPress Plugin WP Fusion Pro versions = 3.47.13...

PT-2026-86804

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-14444: Improper Privilege Management

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-POC

SecNeural // CVE PoC Collection Authorized, defensive vulnera...

CVE-2026-14975

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2026-14975 WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2026-14975 WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

EUVD-2026-71881

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2026-14975

The WP File Download WordPress plugin (all versions up to and including 6.3.8 ) is vulnerable to Directory Traversal via the remoteurl parameter, discovered by 0xd4rk5id3 (EnvoraSec). An authenticated attacker with Subscriber-level access first poisons the _wpfd_file_metadata['file'] post-meta va...

SUSE CVE-2026-80893

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork copyhugetlbpagerange clears the uffd-wp bit of migration and hwpoison entries with hugepteclearuffdwp, which operates on the present-PTE bit position. Swap entri...

CVE-2026-83627: Improper Control of Generation of Code

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the logmsg function in core/modules/class-page-cache.php. The page-cache debug log is written to...

CVE-2026-14975: Improper Limitation of a Pathname to a Restricted Directory

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

PT-2026-86318

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

WordPress WP File Download plugin <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter vulnerability

Authenticated Subscriber+ Arbitrary File Read via Path Traversal in 'remoteurl' Parameter vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin WP File Download versions = 6.3.8...