CVE-2026-125912

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress contex...

CVE-2026-125912

The WP Ultimate CSV Importer WordPress plugin versions before 9.2 is vulnerable to arbitrary PHP code execution within the shared WordPress context. The root cause is a failure to restrict the destination filename and extension, as well as a lack of validation for the fetched content type during ...

WordPress WP Ultimate CSV Importer plugin < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution vulnerability

Multisite Subsite Admin+ Network-Wide PHP Code Execution vulnerability discovered by Charles Vosburgh in WordPress Plugin WP Ultimate CSV Importer versions 9.2...

CVE-2026-125912 WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress contex...

EUVD-2026-124853

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress contex...

Theme My Login <= 7.2.1 - Privilege Escalation

Theme My Login TML retrievepassword - wpupdateuser, this filter fires on the EXISTING target user, overwriting their password with an attacker-chosen value. An unauthenticated attacker can therefore take over any account, including a network administrator, by sending userpass1 in the lost-passwor...

My Calendar WordPress Plugin - Information Disclosure

My Calendar WordPress plugin = 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parsestr in mcajaxmcjsaction endpoint, letting unauthenticated attackers access or crash sites via switchtoblog, exploit requires WordPress Multisite or Single Site setup. id:...

CVE-2026-106468

The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate...

EUVD-2026-123156

The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate...

CVE-2026-106468 Code Snippets < 4.1.0 - Admin+ Network-Scoped Snippet Injection via Snippet Import

The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate...

CVE-2026-106468

The Code Snippets WordPress plugin versions before 4.1.0 is vulnerable to a network-scoped snippet injection. The flaw exists because the plugin fails to verify network-level capabilities when processing a network-scope parameter on its snippet import routes in a multisite environment. This allow...

tvsz

CVE-2018-6389 PoC node js multisite with proxy This script is based on CVE-2018-6389, a rather insidious problem in Wordpress, which unfortunately will likely not be fixed by the team developing the platform, even though it has been known for quite some time. !!! IMPORTANT BEFORE YOU CONTINUE !!!...

CVE-2026-106468: Unknown Code Snippets: The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a…

The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate...

PT-2026-144987

The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate...

CVE-2026-121875

The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management...

CVE-2026-121874

The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves...

CVE-2026-121874 Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name

The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves...

CVE-2026-121874 Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name

The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves...

EUVD-2026-119826

The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves...

CVE-2026-121875

The Post Duplicator WordPress plugin (versions before 3.0.18 ) contains a privilege escalation vulnerability due to a lack of validation for capabilities assigned to roles via its permissions settings. This flaw allows a site administrator on a multisite network who is not a Super Admin to grant ...