11710 matches found
EUVD-2026-51942
The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds...
EUVD-2026-51938
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new...
EUVD-2026-51935
The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users...
CVE-2026-14864 JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as...
CVE-2026-15151
The CVE-2026-15151 issue affects the Five Star Restaurant Reservations WordPress plugin prior to version 2.7.23. A missing capability check on an AJAX action (rtb_reset_notifications) allows users with the lowest booking-management role to reset the site’s configured booking notification rules. T...
CVE-2026-14864
CVE-2026-14864 affects the JetEngine WordPress plugin up to version 3.8.12. The vulnerability arises because a post meta value is not escaped before being output by a JetEngine shortcode, enabling Stored XSS when exploited by users with Contributor role or higher. Impact is that an attacker could...
EUVD-2026-51924
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates...
PT-2026-67135
Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw exists in the full-scope-disabled client-policy executor within the keycloak-services component, which enforces security policies during client registration and...
CVE-2026-67311
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...
CVE-2026-67311
Budibase before 3.38.1 is affected by a server-side request forgery in the REST datasource integration. The vulnerability arises because redirects are not validated against the IP blacklist, enabling an attacker with Builder role to configure a REST datasource that returns a redirect to internal ...
CVE-2026-67311 Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...
CVE-2026-16635
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
CVE-2026-16635
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
EUVD-2026-51795
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
CVE-2026-16635 Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
CVE-2026-16635
The CVE concerns the Pronamic Pay plugin for WordPress (up to version 10.1.0). The vulnerability lies in the maybe_update_user_role() function, which passes an attacker-controlled Gravity Forms field value ($lead[$feed->user_role_field_id]) directly into WP_User::set_role() without allowlist v...
CVE-2026-14292
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...
EUVD-2026-51706
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...
CVE-2026-14292
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...
EUVD-2026-51705
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request...