CVE-2022-1051

CVE-2022-1051 WPQA 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields Description The plugin, used as a companion plugin for the Discy and Himer themes, does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any...

CVE-2026-93902

The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above...

EUVD-2026-118903

The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above...

CVE-2026-93902

The Soledad theme for WordPress (versions up to and including 8.7.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) via Social Profile Fields . The root cause is insufficient input sanitization and output escaping , allowing authenticated attackers with subscriber-level access or higher to i...

CVE-2026-93902 Soledad <= 8.7.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Social Profile Fields

The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above...

CVE-2026-119213

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration FeedIntegration::notify opens a ticket fr...

EUVD-2026-118562

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration FeedIntegration::notify opens a ticket fr...

WordPress Fluent Support – Helpdesk & Customer Support Ticket System plugin <= 2.4.7 - Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields vulnerability

Fluent Support = 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields vulnerability discovered by Santh in WordPress Plugin Fluent Support versions = 2.4.7...

PT-2026-137103

Name of the Vulnerable Software and Affected Versions Zulip versions 11.0 through 12.1 Description Organizations with web-public channels enabled expose the 'GET /json/users' endpoint to unauthenticated spectators. A missing access-control check allows the include custom profile fields variable,...

CVE-2026-45144

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, GET /user/username is anonymously reachable and renders six user-editable profile fields firstname, lastname, competences, openarea, teach, and diplomas inside % autoescape false %, without server-side sanitization ...

EUVD-2026-113996

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, GET /user/username is anonymously reachable and renders six user-editable profile fields firstname, lastname, competences, openarea, teach, and diplomas inside % autoescape false %, without server-side sanitization ...

CVE-2026-45144

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, "GET /user/username" is anonymously reachable and renders six user-editable profile fields "firstname", "lastname", "competences", "openarea", "teach", and "diplomas" inside "% autoescape false %", without server-si...

CVE-2026-45144: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, GET /user/username is anonymously reachable and renders six user-editable profile fields firstname, lastname, competences, openarea, teach, and diplomas inside % autoescape false %, without server-side sanitization ...

PT-2026-133605

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, GET /user/username is anonymously reachable and renders six user-editable profile fields firstname, lastname, competences, openarea, teach, and diplomas inside % autoescape false %, without server-side sanitization ...

CVE-2026-108685

The WP Post Author WordPress plugin (versions before 4.2.0 ) is vulnerable to an unauthenticated modification of the first user account's profile fields. The root cause is a failure to verify account creation timestamps during front-end registration; if a registration form declares specific field...

WordPress WP Post Author plugin < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields vulnerability

Unauthenticated Modification of the First User Account's Profile Fields vulnerability discovered by Mutantgun in WordPress Plugin WP Post Author versions 4.2.0...

CVE-2026-108685 WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...

CVE-2026-108685 WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...

PT-2026-127898

The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save profile fields function that uses an isset condition at line 1119, allowing the security check to be complete...

Linux Distros Unpatched Vulnerability : CVE-2026-17025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versio...