CVE-2026-18480

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

EUVD-2026-37639

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.4 versions...

EUVD-2025-210230

Subscriber Privilege Escalation in Genemy = 1.6.6 versions...

CVE-2026-54805

Subscriber Privilege Escalation in Falang multilanguage = 1.4.2 versions...

CVE-2026-54805 WordPress Falang multilanguage plugin <= 1.4.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Falang multilanguage = 1.4.2 versions...

PT-2026-50354

Name of the Vulnerable Software and Affected Versions JetFormBuilder versions prior to 3.6.2 Description The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress allows authenticated attackers with Subscriber-level access and above to elevate their privileges. Recommendations Update ...