281 matches found
CVE-2025-1304
🚨 WordPress NewsBlogger Theme = 0.2.5.1 - Arbitrary File Upload CVE-2025-1304 CVSS Score: 8.8 High Vulnerability Type: Arbitrary File Upload Component: WordPress Theme CVE ID: CVE-2025-1304 🔥 Vulnerability Overview The NewsBlogger WordPress theme versions = 0.2.5.1 is vulnerable to an Arbitrary...
CVE-2026-87888
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
EUVD-2026-76801
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
CVE-2026-87888 YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
CVE-2026-87888
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
CVE-2026-62132 WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...
CVE-2026-62106 WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...
CVE-2026-62102
CVE-2026-62102 affects the WordPress Gato GraphQL plugin in versions 19.2.3 and earlier , where a Subscriber-level privilege escalation vulnerability exists. The CVSS 3.1 score is 8.8 (HIGH) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-attackable flaw requiring only l...
EUVD-2026-76196
Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...
CVE-2026-62102 WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...
CVE-2026-81803
Subscriber Remote Code Execution RCE in RepairBuddy = 4.1224 versions...
CVE-2026-81801
The WP-Stateless WordPress plugin (versions ≤ 4.4.1) is affected by a Settings Change vulnerability discovered by Johan Buenavida via Patchstack. The flaw allows a low-privileged user (e.g., subscriber) to modify settings they should not have access to, over a network with low complexity and no u...
CVE-2026-81788
CVE-2026-81788 affects the WordPress IMPress for IDX Broker plugin in versions
CVE-2026-81783 WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability
Subscriber Broken Authentication in MailMunch – Grow your Email List = 3.2.5 versions...
CVE-2022-0439
CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Subscriber+ Blind SQL injection Must Have sqlmap installed & a valid username & password with subscriber+ Usage root@kitploit: usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message...
CVE-2026-84066
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
EUVD-2026-70912
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
CVE-2026-84814
Subscriber Privilege Escalation in Bricksforge = 3.1.8.8 versions...