16407 matches found
EUVD-2026-62266
The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...
EUVD-2026-62265
The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...
CVE-2026-14825 Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR
The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...
CVE-2026-13173 Eventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation
The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata...
CVE-2026-13175
The Eventin WordPress plugin before 4.1.21 suffers from an IDOR flaw: schedule records are modified or deleted without ownership checks, allowing contributor-level users to alter or remove other users' entries. CVSS 6.5 (MEDIUM) rates this as network-exploitable with high privileges required. No ...
CVE-2026-13173
The Eventin WordPress plugin before 4.1.21 lacks capability checks during speaker creation, allowing contributor-level users to modify other users' roles and metadata. CVSS 2.7 LOW (PR:H). No exploitation reported. Upgrade to 4.1.21 to remediate.
EUVD-2026-62261
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...
CVE-2026-13175 Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...
EUVD-2026-62259
The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata...
EUVD-2026-62260
The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...
CVE-2026-13174
The Eventin WordPress plugin before 4.1.21 has an IDOR flaw: contributor-level users can permanently delete other users' accounts. Update to 4.1.21 or later. No active exploitation reported. Patch via the Eventin plugin update page. Details: https://wpscan.com/vulnerability/849478d1-640f-49e0-8fa...
EUVD-2026-62219
The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2025-210740
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...
CVE-2025-11729
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...
PT-2026-78309
Name of the Vulnerable Software and Affected Versions EWWW Image Optimizer versions prior to 8.7.4 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. An attacker can embed a...
CVE-2025-11729
The WordPress PPWP plugin (≤1.9.15) has an improper capability check in its can_access function, allowing authenticated Contributors and above to retrieve the master password and bypass protection on any password-protected post or page. CVSS 4.3 (Medium). The plugin's changelog shows a fix was ap...
CVE-2025-11729 PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...
CVE-2026-74003
Contributor Broken Access Control in RomethemeForm For Elementor = 1.2.6 versions...