CVE-2026-86445

The LearnPress WordPress plugin (versions 4.2.9–4.4.6 ) contains an unauthenticated information disclosure in its load_content_via_ajax administrative template handler, which fails to verify user capabilities. Attackers can retrieve the text, identifier, and type of every published quiz question,...

CVE-2026-86449 LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...

CVE-2026-86445 LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, whi...

CVE-2026-85131

WPLP Cookie Consent (WordPress plugin, also known as WP Cookie Notice for GDPR, CCPA & ePrivacy Consent) versions before 4.4.4 are vulnerable to arbitrary post and page deletion via CSRF. The plugin fails to perform CSRF or capability checks when processing bulk actions on its administration scre...

CVE-2026-84905 Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploadin...

CVE-2026-85131 WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts...

EUVD-2026-80192

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploadin...

CVE-2026-84905

The Eventin WordPress plugin (also known as WP Event Solution) before 4.1.24 contains a privilege escalation vulnerability discovered by Karthik Ramakrishnan. When adding a speaker, the plugin fails to verify the acting user's capability to create accounts. This allows any user with contributor-l...

CVE-2026-11984

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...

EUVD-2026-80096

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...

CVE-2026-75983

The Eventin WordPress plugin (≤ 4.1.23 ) contains a privilege escalation vulnerability in PermissionManager::manage_permissions(), which is hooked into WordPress's map_meta_cap filter and unconditionally returns an always-true primitive for user ID 1 without scoping to plugin-specific capabilitie...

EUVD-2026-78298

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the PermissionManager::managepermissions function being registered as a callback on WordPress core's...

CVE-2025-5394

🚨 CVE-2025-5394 - Subida Arbitraria de Plugins No Autenticada en el Tema Alone 📌 Producto afectado: Alone – Tema WordPress multipropósito para caridad sin fines de lucro Versiones: = 7.8.3 CVE: CVE-2025-5394 Puntuación CVSS: 9.8 Crítico 🔥 Resumen de la vulnerabilidad: El tema Alone para WordPress...

kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns

A flaw was found in the Linux kernel's rtnetlink component. An unprivileged local user, leveraging a user namespace, can exploit a missing CAPNETADMIN capability check in the rtnlnewlink function. This allows the user to create paired network devices in arbitrary network namespaces, including the...

CVE-2024-12172

CVE-2024-12172 WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses = 3.2.21 - Autorización faltante para usuarios autenticados Suscriptor+ que permite la actualización arbitraria de metadatos de usuario Descripción El plugin WP Courses LMS – Online...

CVE-2024-10578

CVE-2024-10578: Pubnews = 1.0.7 - 未经认证的任意插件安装 描述 Pubnews WordPress 主题在所有版本（包括 1.0.7）中，由于 pubnewsimporterpluginactionfornotice 函数缺少权限检查，导致存在未经授权的任意插件安装漏洞。此漏洞允许拥有订阅者级别及以上的已认证攻击者安装任意插件，进而可利用这些插件来利用其他漏洞。 CWE CWE-434: 危险类型文件的不受限制上传 CVSS 评分: 8.8 高危 版本: 3.1 向量字符串:...

CVE-2026-88802

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...

CVE-2026-88802

CVE-2026-88802 affects two WordPress plugins: MDJM Event Management (before 1.7.8.5) and Mobile Events Manager (through 1.4.8.3). The root cause is the absence of a capability check, nonce validation, or record-type verification in the plugins' playlist entry removal endpoint. An unauthenticated ...

CVE-2024-9707

CVE-2024-9707 Hunk Companion = 1.8.4 - Falta de autorización que permite a atacantes no autenticados instalar/activar plugins arbitrarios Descripción El plugin Hunk Companion para WordPress es vulnerable a la instalación/activación no autorizada de plugins debido a una falta de comprobación de...

CVE-2025-5701

CVE-2025-5701 HyperComments = 1.2.2 - Unauthenticated Subscriber+ Arbitrary Options Update Description The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function...