CVE-2026-32467

CVE-2026-32467 affects the WordPress "[Aotuman] Grab WeChat Articles" plugin up to version 2.0.1. Authenticated subscribers can trigger an SSRF by causing the server to fetch arbitrary internal/external URLs, enabling internal network probing or external requests. CVSS 6.0 MEDIUM (AV:N/AC:H/PR:L/...

CVE-2026-32467 WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-32467

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-32466 WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

EUVD-2026-60902

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

CVE-2026-32466

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

CVE-2026-32466 WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

CVE-2026-32466

The Gravity Forms Bookings premium WordPress plugin (versions ≤ 2.1) contains a SQL injection flaw exploitable by authenticated subscribers. CVSS 8.5 (HIGH) reflects network access with low privileges. Patchstack reports it; no in-the-wild exploitation or patch version details are provided in the...

CVE-2026-28191 WordPress The Grid plugin <= 2.7.9.1 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

CVE-2026-28191

A privilege escalation vulnerability affects the WordPress plugin The Grid (versions

CVE-2026-28191

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

EUVD-2026-60890

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

CVE-2026-28191 WordPress The Grid plugin <= 2.7.9.1 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

WordPress Query Wrangler plugin <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter vulnerability

Authenticated Subscriber+ Remote Code Execution via 'options' Parameter vulnerability discovered by Enis - TURKOL YAZILIM in WordPress Plugin Query Wrangler versions = 1.5.57...

PT-2026-77062

Name of the Vulnerable Software and Affected Versions Modal Survey versions prior to 2.0.2.2.4 Description An Insecure Direct Object Reference IDOR exists, which occurs when an application provides direct access to objects based on user-supplied input, potentially allowing unauthorized access to...

PT-2026-77116

Name of the Vulnerable Software and Affected Versions MWB HubSpot for WooCommerce versions prior to 1.6.8 Description The software contains a broken authentication mechanism that allows users with Subscriber privileges to bypass authentication requirements. Recommendations Update MWB HubSpot for...

WordPress Wholesale Market plugin <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via 'rolerequired' Parameter vulnerability discovered by SEONGWON CHO - Chung-ang University in WordPress Plugin Wholesale Market versions = 2.2.2...

WordPress Cookie Banner for GDPR / CCPA plugin <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.5...

WordPress bLoyal: Loyalty & Promotions by bLoyal plugin <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings vulnerability

Authenticated Subscriber+ Privilege Escalation via Unprotected AJAX API URL Settings vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin bLoyal versions = 3.1.611.78...

CVE-2026-10734

The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...