CVE-2026-104799

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmpprofilesettings REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key allow-lis...

CVE-2026-110964

The Essential Real Estate WordPress plugin (versions 4.4.3-5.3.4 ) is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The application fails to verify if a media attachment belongs to the requesting user before processing a deletion request. This allows a self-registered customer-le...

CVE-2026-110964 Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR

The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators...

CVE-2026-105191 WP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit Log

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users'...

WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server. id:...

WordPress Bit File Manager < 6.9.1 - Arbitrary File Read

The Bit File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory. id: CVE-2026-17540 info: name: WordPress Bit File...

CVE-2026-76124

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the sendfeedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content...

EUVD-2026-115810

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the sendfeedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content...

CVE-2026-76124

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 3.2.1 . The flaw exists in the send_feedback function due to insufficient file type validation, which relies exclusively on the client-supplied Content-Type header without server-side...

CVE-2026-76124 BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the sendfeedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content...

WordPress AZEXO Store Locator plugin <= 1.4 - Subscriber+ Arbitrary Post Deletion vulnerability

Subscriber+ Arbitrary Post Deletion vulnerability discovered by Nguyen Huu Do in WordPress Plugin AZEXO Store Locator versions = 1.4...

WordPress News Kit Addons For Elementor plugin <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Mohamed Amgad Khater mamgad in WordPress Plugin News Kit Elementor Addons versions = 1.4.8...

WordPress Photo Engine (Media Organizer & Lightroom) plugin <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Photo Engine versions = 6.5.7...

CVE-2026-115205 AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary Post Deletion via azt_delete_item

The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages...

CVE-2026-115205

The AZEXO Store Locator WordPress plugin (versions through 1.4 ) contains a broken access control vulnerability. The plugin fails to implement necessary capability checks or authorization controls when processing post deletions, specifically via the azt_delete_item function. This flaw allows any ...

CVE-2026-120575

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy.name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-120524

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-115670

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy.name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-120575 Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy.name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-120575

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.5.7 . The root cause is insufficient input sanitization and output escaping of the 'hierarchy[].name' parameter. Authenticated attackers wit...