CVE-2026-85126 Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover...

CVE-2026-85126

The Crowdfundly WordPress plugin (versions through 2.2.2 ) is vulnerable to privilege escalation due to a lack of capability checks on specific AJAX actions . An attacker with a low-privileged role within the plugin can exploit this to grant themselves the administrator role or arbitrary capabili...

EUVD-2026-96286

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to IdTokenServiceDeprecated::processopenidconnecttoken using the incompatible WordPress...

GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...

CVE-2014-125130

The CodeArt Google MP3 Audio Player plugin for WordPress (versions through 1.0.11 ) is vulnerable to an unauthenticated arbitrary file read vulnerability. This flaw exists due to a path-traversal vulnerability in the file parameter of the direct_download.php file. Remote attackers can exploit thi...

CVE-2026-19652 Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter

The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the dmemformsubmithandler function determining the new user's role by iterating all WordPress roles and calling passwordverify against an attacker-controlled bcry...

CVE-2026-19660 Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter

The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The processpaypalcallback function, hooked to the init action, accepts a base64-encoded paypalparam GET parameter with no IPN validation, no cryptographic signature check, ...

PT-2026-104336

Name of the Vulnerable Software and Affected Versions Divi Membership versions prior to 2.2.1 Description An issue exists in the dmem form submit handler function that allows unauthenticated attackers to escalate privileges. The function determines a new user's role by iterating through all...

CVE-2026-15983: External Control of File Name or Path

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

CVE-2026-19125 EthPress <= 2.3.5 - Unauthenticated Authentication Bypass

The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verifylogin function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2...

CVE-2026-19125 EthPress <= 2.3.5 - Unauthenticated Authentication Bypass

The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verifylogin function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2...

CVE-2026-19125

The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.3.5 . The root cause is a missing return statement in the verify_login() function within app/Login.php. When Signature::verify2() detects a signature mismatch, the function ...

PT-2026-97598

Name of the Vulnerable Software and Affected Versions EthPress – Web3 Login plugin for WordPress versions prior to 2.3.6 Description An authentication bypass exists due to a missing return statement in the verify login function within app/Login.php. When the Signature::verify2 function detects a...

CVE-2026-19125: Improper Authentication

The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verifylogin function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2...

CVE-2026-13598

The RestrictMate WordPress plugin (versions before 1.3.0 ) contains an unauthenticated privilege escalation vulnerability. The root cause is that the plugin fails to restrict the user role provided during the account registration process. This allows an unauthenticated attacker to register a new ...

EUVD-2026-64635

The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover...

PT-2026-79759

The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover...

CVE-2026-75860

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user...

CVE-2026-75860

The JSON Options WordPress plugin, affecting versions prior to 0.0.5 (through 0.0.4), is vulnerable to an unauthenticated arbitrary options update . The root cause is a lack of capability checks and nonce verification on an action that executes on every request. This flaw allows unauthenticated a...

CVE-2026-75860 JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user...