CVE-2026-66647 WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Homlisti = 3.1.2 versions...

CVE-2026-66647

CVE-2026-66647 is a Broken Access Control vulnerability in the WordPress Homlisti theme , affecting versions 3.1.2 and below . The flaw allows a user with Subscriber privileges to perform actions beyond their intended access level, resulting in a high integrity impact (CVSS 3.1 score: 6.5 MEDIUM ...

EUVD-2026-63301

Subscriber Broken Access Control in Homlisti = 3.1.2 versions...

EUVD-2026-63342

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66601 WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66601

Subscriber-level authenticated users can inject arbitrary JavaScript into the Media Library Assistant plugin (≤3.39) admin interface, enabling session hijacking or data theft. CVSS 6.5 (MEDIUM). Update to version 3.40 or later; no in-the-wild exploitation reported. See: https://patchstack.com/dat...

EUVD-2026-63337

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

CVE-2026-66594 WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

CVE-2026-66594

The WordPress Persistent Login plugin (versions ≤ 3.1.0) has a subscriber-level SQL injection vulnerability exploitable over the network with low privileges. CVSS 8.5 (HIGH) reflects high confidentiality impact and low availability impact. No in-the-wild exploitation is reported. Upgrade to a ver...

WordPress Wired Impact Volunteer Management plugin < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp vulnerability

Subscriber+ Arbitrary RSVP Removal via wivmremoversvp vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Wired Impact Volunteer Management versions 2.8.2...

PT-2026-78978

Name of the Vulnerable Software and Affected Versions Leyka versions prior to 3.32.4 Description Broken authentication exists for subscribers, allowing potential unauthorized access to accounts. Recommendations Update to a version newer than 3.32.3...

PT-2026-78990

Name of the Vulnerable Software and Affected Versions Smart Cleaning versions prior to 4.8.7 Description An arbitrary file upload issue exists that allows users with subscriber privileges to upload unauthorized files to the system. Recommendations Update to a version newer than 4.8.6...

PT-2026-78988

Name of the Vulnerable Software and Affected Versions eShipper Commerce versions prior to 2.16.14 Description An SQL Injection issue exists in the subscriber component, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update to a versio...

PT-2026-78991

Name of the Vulnerable Software and Affected Versions Warehouse Cargo versions prior to 2.7.0 Description An issue allows subscribers to perform arbitrary file uploads, which could lead to the upload of unauthorized files to the server. Recommendations Update to a version newer than 2.6.9...

PT-2026-78989

Name of the Vulnerable Software and Affected Versions IT Residence versions prior to 3.2.2 Description An arbitrary file upload issue exists that allows a subscriber to upload unauthorized files to the system. Recommendations Update to a version newer than 3.2.1...

PT-2026-78974

Name of the Vulnerable Software and Affected Versions Homlisti versions prior to 3.1.3 Description Broken access control exists for subscribers, allowing unauthorized access or actions. Recommendations Update to a version newer than 3.1.2...

CVE-2026-66668

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

CVE-2026-32552

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

EUVD-2026-62376

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

CVE-2026-66668

CVE-2026-66668 is a Subscriber SQL Injection vulnerability in the Community by PeepSo WordPress plugin, affecting versions ≤ 9.0.5.2 . The vulnerability was discovered by Yukusawa18 and reported via Patchstack. The CVSS 3.1 base score is 8.5 (HIGH) , with a network attack vector, low complexity, ...