CVE-2026-96815

Custom role Privilege Escalation in Vitepos = 3.5.0 versions...

CVE-2026-96344

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96815

The Vitepos plugin for WordPress (versions

EUVD-2026-89868

Custom role Privilege Escalation in Vitepos = 3.5.0 versions...

EUVD-2026-89857

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96344 WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96344

The eCommerce Product Catalog plugin for WordPress (versions

CVE-2026-96344 WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96343 WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

CVE-2026-96343

The WP ERP plugin for WordPress, in versions

CVE-2026-96343 WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

CVE-2026-96343: Deserialization of Untrusted Data

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

CVE-2026-96344: Deserialization of Untrusted Data

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96815: Incorrect Privilege Assignment

Custom role Privilege Escalation in Vitepos = 3.5.0 versions...

WordPress Import and export users and customers plugin < 2.5.2 - Custom Role Privilege Escalation to Administrator vulnerability

Custom Role Privilege Escalation to Administrator vulnerability discovered by BINESH MADHARAPU in WordPress Plugin Import and export users and customers versions 2.5.2...

EUVD-2026-83515

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...

GO-2026-6371 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision in github.com/semaphoreui/semaphore

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision in github.com/semaphoreui/semaphore...

WordPress Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin <= 1.31.0 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.0...

CVE-2026-77079 n8n before 2.34.1 Authorization Bypass via Custom Role Deletion

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion reassignment path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorizati...

BIT-GITLAB-2025-9486 Incorrect Privilege Assignment in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...