CVE-2026-73992

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

CVE-2026-73992

The WordPress Query Wrangler plugin (versions ≤ 1.5.57) allows authenticated subscribers to execute arbitrary code remotely, yielding full server compromise (CVSS 9.9 Critical, network-exploitable with low complexity). No in-the-wild exploitation or patch version is documented in the provided sou...

EUVD-2026-63311

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

CVE-2026-73992 WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

CVE-2026-73992 WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

PT-2026-78984

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

CVE-2026-73992: Improper Control of Generation of Code

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by hhhai in WordPress Plugin Query Wrangler versions = 1.5.57...

WordPress Query Wrangler plugin <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter vulnerability

Authenticated Subscriber+ Remote Code Execution via 'options' Parameter vulnerability discovered by Enis - TURKOL YAZILIM in WordPress Plugin Query Wrangler versions = 1.5.57...

CVE-2026-14498

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-14498

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

EUVD-2026-59852

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-14498

Affected software: Query Wrangler plugin for WordPress (tested up to version 1.5.57). Vulnerability: Remote Code Execution via the options parameter in the wp_ajax_qw_form_ajax handler. Root cause is a missing capability check and nonce verification, with unsanitized attacker-controlled options b...

CVE-2026-14498 Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-14498 Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-14498: Unrestricted Upload of File with Dangerous Type

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

PT-2026-73085

Name of the Vulnerable Software and Affected Versions Query Wrangler versions prior to 1.5.58 Description Authenticated attackers with subscriber-level access and above can achieve Remote Code Execution on the server. The issue exists in the wp ajax qw form ajax handler due to a lack of capabilit...

conversation-qa (0.0.9), creak-sense (>=0.0.1, <=0.0.2) +5 more potentially affected by CVE-2026-68770 via sentence-transformers (2.0.0)

sentence-transformers PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - conversation-qa 0.0.9 - creak-sense =0.0.1, =0.1.0, =0.1.1, =0.1.1, =0.0.1, =0.0.2 Source cves: CVE-2026-68770 Source...

Malicious Package

Overview create-wrangler-deploy is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

adaptnlp (>=0.3.0, <=0.3.5), autonlp (>=0.2.8, <=0.3.2) +3 more potentially affected by CVE-2026-66007 via datasets (1.8.0)

datasets PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - adaptnlp =0.3.0, =0.2.8, =1.37.0, =3.1.0, =0.1.1, =0.1.7 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...