CVE-2026-88931

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

EUVD-2026-95504

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

CVE-2026-85004

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option...

EUVD-2026-91188

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option...

CVE-2026-85004

The Popup Maker WordPress plugin (versions through 1.4.5 ) is vulnerable to a missing authorization flaw due to a failure to perform a capability check on the sgpm_connect account-connection action. While the plugin verifies a nonce, it fails to restrict access to specific roles, allowing authent...

CVE-2026-85004: Improper Access Control

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option...

PT-2026-104086

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option...

PT-2026-95736

Name of the Vulnerable Software and Affected Versions SEO Booster versions prior to 7.4.8 Description The SEO Booster plugin for WordPress contains a missing authorization flaw. The handle oauth callback function, which is hooked to admin init, fails to perform a capability check when processing...

PT-2026-95272

Name of the Vulnerable Software and Affected Versions Filter Gallery versions prior to 1.1.5 Description The plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with subscriber-level access or higher to overwrite the title and...

CVE-2026-85681: Improper Privilege Management

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site'...

EUVD-2026-48382

The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the AjaxService::verifyajaxrequest helper gating its wpverifynonce call behind the boolean option 'enablenoncecheck', which is absent from the default...

CVE-2026-12407

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screenaction function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path...

CVE-2023-5098

The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges like subscribers from overwriting any options on a site with the string "true", which could lead to a variety of outcomes, including DoS...

PT-2023-31718

Name of the Vulnerable Software and Affected Versions Campaign Monitor Forms by Optin Cat WordPress plugin versions prior to 2.5.6 Description The issue allows users with low privileges, such as subscribers, to overwrite any options on a site with the string "true", potentially leading to various...