WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Read vulnerability

Subscriber+ Arbitrary File Read vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...

CVE-2026-32564

Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-80433

SureFeedback Client Site is a WordPress plugin vulnerable to Subscriber-level Sensitive Data Exposure in versions 1.2.12 and below . The CVSS 3.1 score is 7.5 (High) , with a network attack vector requiring no privileges or user interaction, and a high impact on confidentiality but no impact on i...

CVE-2026-80433 WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...

CVE-2026-78285

WordPress Like Button Rating plugin (versions

CVE-2026-78285 WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability

Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...

CVE-2026-32564

CVE-2026-32564 is a Subscriber-level SQL Injection in the ACPT (Pro) – Custom Post Types Plugin for WordPress (versions ≤ 2.0.63 ), discovered by VDsec. The vulnerability allows a low-privilege (Subscriber) authenticated user to inject SQL, resulting in HIGH confidentiality impact with changed sc...

EUVD-2026-66990

Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32564 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability

Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

WordPress AI Engine plugin < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription vulnerability

Subscriber+ Arbitrary File Read via Audio Transcription vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.6...

CVE-2026-78138

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

CVE-2026-77016

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...

CVE-2026-77017

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

CVE-2026-77017 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

EUVD-2026-66884

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...

CVE-2026-77018 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

CVE-2026-77018

The Workeera WordPress plugin (Remote Tech Job Board) before 1.0.6 allows users with a subscriber role to submit unrestricted profile values, which the plugin writes as an unvalidated file into a publicly reachable directory. This mass-assignment flaw enables arbitrary file upload and, consequent...

EUVD-2026-66879

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

CVE-2026-77017

CVE-2026-77017 affects the Workeera Remote Tech Job Board WordPress plugin in versions prior to 1.0.6 . The root cause is a mass assignment flaw in the candidate profile feature: the plugin does not restrict which profile values a candidate may submit, nor does it confine the stored file location...

EUVD-2026-66878

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...