36 matches found
CVE-2026-16965
The Solace Extra WordPress plugin prior to 1.6.1 is affected. An AJAX action lacks capability/nonce checks, enabling any authenticated user (e.g., subscriber) and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site’s active templates. No exploit details...
EUVD-2026-54889
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...
EUVD-2026-54743
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...
CVE-2026-16948
The CVE concerns the Solace Extra WordPress plugin prior to version 1.6.1. The issue stems from missing capability checks in several AJAX actions and exposure of the nonce protecting them on admin pages, which low-privilege users (down to the Subscriber role) can access. This allows modification ...
CVE-2026-16948
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...
CVE-2026-13250
The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete all...
EUVD-2026-43141
The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete all...
CVE-2026-13250 Solace Extra <= 1.5.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJAX Action
The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete all...
CVE-2026-13250
Solace Extra (WordPress) up to version 1.5.3 is affected by an authorization bypass in the delete_previously_imported AJAX action. The issue allows unauthenticated users to permanently delete content imported via the Starter Template (posts, pages, media, WooCommerce products, terms, sitebuilder ...
EUVD-2025-11724
Malicious code in bioql PyPI...
EUVD-2025-13853
Malicious code in bioql PyPI...
CVE-2025-58203
Server-Side Request Forgery SSRF vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through = 1.3.2...
WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability
Server Side Request Forgery SSRF Vulnerability discovered by Que Thanh Tuan Blue Rock in WordPress Plugin Solace Extra versions = 1.3.2...
CVE-2025-58203
Server-Side Request Forgery SSRF vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through = 1.3.2...
CVE-2025-58203 WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability
Server-Side Request Forgery SSRF vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through = 1.3.2...
CVE-2025-58203
CVE-2025-58203 describes a Server-Side Request Forgery (SSRF) in the WordPress plugin Solace Extra (Solace Extra: from n/a through 1.3.2). Connected sources indicate the vulnerability affects versions up to 1.3.2 and that a patch exists (the entry is listed as Patched); no exploit details are pro...
CVE-2025-58203 WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability
Server-Side Request Forgery SSRF vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through = 1.3.2...
WordPress plugin Solace Extra 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...
PT-2025-34917 · WordPress · Solacewp Solace Extra
Name of the Vulnerable Software and Affected Versions: solacewp Solace Extra versions through 1.3.2 Description: A Server-Side Request Forgery SSRF vulnerability exists in solacewp Solace Extra, allowing Server Side Request Forgery. Recommendations: At the moment, there is no information about a...