CVE-2026-88845

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own accoun...

CVE-2023-4823 WP Meta and Date Remover < 2.2.0 - Subscriber+ Stored XSS

The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change...

PT-2021-15890

Name of the Vulnerable Software and Affected Versions Simple 301 Redirects by BetterLinks WordPress plugin versions prior to 2.0.4 Description The issue is related to a lack of capability checks and insufficient nonce check on the AJAX action in the plugin, allowing authenticated users to install...

CVE-2017-9065: Improper Input Validation

In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API...