CVE-2025-15260

CVE-2025-15260: Missing Authorization / Broken Access Control in Plugin - MyRewards – Loyalty Points and Rewards for WooCommerce Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. ...

CVE-2025-15481 Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

CVE-2025-15481

The Notification Bar for WordPress plugin (slug 8-degree-notification-bar) through version 1.1.8 exposes an unauthenticated CSV export script at inc/backend/blocks/export-csv.php, allowing anyone to download all stored subscriber email addresses without authentication. The vulnerability is rated ...

CVE-2025-15481 Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

CVE-2026-77009 WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...

CVE-2026-77009

CVE-2026-77009 affects the WatchMan-Site7 WordPress plugin through version 4.2.0 . The plugin fails to restrict access to its debugging console , which executes user-supplied PHP code . Any authenticated user with a low privilege level (e.g., a subscriber ) can leverage this to achieve remote cod...

CVE-2025-1304

🚨 WordPress NewsBlogger Theme = 0.2.5.1 - Arbitrary File Upload CVE-2025-1304 CVSS Score: 8.8 High Vulnerability Type: Arbitrary File Upload Component: WordPress Theme CVE ID: CVE-2025-1304 🔥 Vulnerability Overview The NewsBlogger WordPress theme versions = 0.2.5.1 is vulnerable to an Arbitrary...

CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

EUVD-2026-69922

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-81283

WP User Frontend is a WordPress plugin affected by a PHP Object Injection vulnerability in versions 4.3.10 and below . The vulnerability requires low privileges (subscriber-level access), no user interaction, and a low attack complexity, making it accessible to any authenticated subscriber on a s...

CVE-2026-16983

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

CVE-2026-14357

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...

CVE-2026-77764

The GamiPress WordPress plugin before version 7.9.9.6 does not properly restrict its video watch-tracking functionality . A user with the Subscriber role (the lowest default WordPress role) can award configured gamification points, achievements, and ranks to arbitrary users—including administrato...

EUVD-2026-69866

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

CVE-2026-19453 JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates th...

CVE-2026-19453

JetBackup WordPress plugin (versions 3.1.7.9 through 3.1.23.3) contains a privilege escalation vulnerability. The plugin fails to verify the role or capabilities of a preserved account before granting administrator privileges during a restore or migration, allowing a subscriber-level user to gain...

WordPress Gutentor plugin < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure vulnerability

Subscriber+ Password Protected Post Password Disclosure vulnerability discovered by Ezekiel Victor in WordPress Plugin Gutentor versions 4.0.6...

EUVD-2026-69865

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-14357

The DevKit Pro plugin for WordPress is vulnerable to missing authorization in versions up to and including 2.3.0 . The root cause is a missing capability check and nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This allows authe...

CVE-2026-14357 DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...