WordPress Meta Box AIO plugin <= 3.11.0 - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter vulnerability

Unauthenticated Privilege Escalation to Administrator to 'rwmbfrontendfieldobjectid' Parameter vulnerability discovered by h0xilo in WordPress Plugin Meta Box AIO versions = 3.11.0...

WordPress Meta Box User Profile plugin < 2.6.0 - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter vulnerability

Unauthenticated Privilege Escalation to Administrator to 'rwmbfrontendfieldobjectid' Parameter vulnerability discovered by h0xilo in WordPress Plugin Meta Box User Profile versions 2.6.0...

CVE-2026-13152

CVE-2026-13152: Escalada de Privilegios No Autenticada en Custom Fields Account Registration For WooCommerce 1.4 -blue.svg 📖 Resumen del Aviso CVE-2026-13152 es una vulnerabilidad de escalada de privilegios no autenticada que afecta al plugin de WordPress Custom Fields Account Registration For...

CVE-2023-43874-e107-CMS-Stored-XSS---MetaCustomTags

e107 CMS XSS Almacenado v2.3.2 Autor: Sergio Descripción: Múltiples vulnerabilidades de Cross Site Scripting XSS en e107 CMS v.2.3.2 permiten a un atacante local ejecutar código arbitrario a través de un script manipulado en los campos Copyright y Author del menú Meta & Custom Tags. Vectores de...

CVE-2026-19598-

CVE-2026-19598 — Pods WordPress Plugin Unauthenticated Privilege Escalation -red.svg Critical Unauthenticated Privilege Escalation CVSS 9.8 — WordPress Pods Plugin ≤ 3.3.9 This tool exploits CVE-2026-19598 , a vulnerability in the WordPress Pods plugin that allows unauthenticated attackers to...

CVE-2026-78905-Facebook-Account-Takeover

CVE-2026-78905 — メタフィッシング Facebook Graph API — OAuthトークンの再利用とセッションハイジャック...

CVE-2026-9766 Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-9766

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.5.1 . The root cause is improper verification of user permissions in the empik_csv_process_emp_log_classes AJAX action, allowing any authenticated user with subscriber-level ...

CVE-2026-1984

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

CVE-2026-1984 Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

CVE-2026-1984

The Ibtana – Ecommerce Product Addons plugin for WordPress contains a missing capability check on the iepa_use_gt_editor AJAX action , affecting all versions up to and including 0.4.7.7 . An authenticated attacker with Subscriber-level access or higher can update or delete arbitrary post meta ent...

CVE-2026-1984 Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

CVE-2026-1984: Missing Authorization

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

WordPress Mapster WP Maps plugin <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write vulnerability

Authenticated Subscriber+ Arbitrary User Meta Write vulnerability discovered by Wordfence PRISM in WordPress Plugin Mapster WP Maps versions = 1.23.0...

CVE-2026-12954

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

EUVD-2026-82756

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-12954 Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-12954

The Mapster WP Maps WordPress plugin (≤ 1.23.0) is vulnerable to Arbitrary User Meta Write via the my_profile_update() function. The function performs no nonce verification, capability check, or allowlist validation on the meta key supplied through the acf-photo-gallery-groups POST parameter befo...

CVE-2026-12954 Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

CVE-2026-17586: Improper Neutralization of Input During Web Page Generation

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...