WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection

CBX Bookmark & Favorite WordPress plugin = 2.0.4 contains a SQL injection caused by insufficient escaping of the 'orderby' parameter, letting authenticated attackers with Subscriber-level access extract sensitive database information id: CVE-2025-13652 info: name: WordPress CBX Bookmark & Favorit...

CVE-2026-12689

The CVE concerns the ProfileGrid WordPress plugin (pre-5.9.9.7) where a missing authorization/ownership check allows authenticated users with Subscriber-level access and above to perform actions on other users’ private-message threads. Affected actions include soft-deleting threads, tampering wit...

CVE-2026-12690

CVE-2026-12690 concerns the ProfileGrid WordPress plugin (pre-5.9.9.7) where license-management actions lack a proper capability check and rely solely on a nonce exposed to any logged-in user. This allows authenticated users with Subscriber-level access and higher to overwrite premium license set...

EUVD-2026-48491

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license setting...

CVE-2026-15420

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

PT-2026-64229

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plus name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, ...

CVE-2026-65530

Technical details for CVE-2026-65530 are not publicly available in the provided documents; the description notes a broken access control in TemplateSpare

EUVD-2026-48131

Subscriber Broken Access Control in TemplateSpare = 4.2.2 versions...

EUVD-2026-48105

Subscriber SQL Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-65494

CVE-2026-65494 affects WordPress via the Dokan Pro plugin ≤ 5.0.2, with a Subscriber SQL Injection vulnerability. The connected data confirms the affected component and the vulnerability class (SQL injection) but does not provide exploit details, affected tables/parameters, or a patch/version to ...

EUVD-2026-48104

Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-65491

Technical details for CVE-2026-65491 are not publicly available in the provided documents; monitor for updates.

EUVD-2026-48102

Subscriber Broken Access Control in Query Wrangler = 1.5.57 versions...

EUVD-2026-48090

Subscriber Broken Access Control in Reviewer = 3.14.2 versions...

EUVD-2026-48089

Subscriber Broken Access Control in ListingPro = 2.9.10 versions...

EUVD-2026-48075

Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...

EUVD-2026-48222

Subscriber Broken Access Control in ЮKassa для WooCommerce = 2.16.1 versions...

CVE-2026-65457

Technical details about CVE-2026-65457 are not publicly available in the provided documents; monitor for updates.

EUVD-2026-48196

Subscriber Remote Code Execution RCE in Advanced Views = 3.8.11 versions...

EUVD-2026-48194

Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...