9556 matches found
CVE-2026-66677 WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability
Subscriber Broken Authentication in Leyka = 3.32.3 versions...
CVE-2026-66647 WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
EUVD-2026-63301
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
CVE-2026-66647
CVE-2026-66647 is a Broken Access Control vulnerability in the WordPress Homlisti theme , affecting versions 3.1.2 and below . The flaw allows a user with Subscriber privileges to perform actions beyond their intended access level, resulting in a high integrity impact (CVSS 3.1 score: 6.5 MEDIUM ...
EUVD-2026-63342
Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...
CVE-2026-66601
Subscriber-level authenticated users can inject arbitrary JavaScript into the Media Library Assistant plugin (≤3.39) admin interface, enabling session hijacking or data theft. CVSS 6.5 (MEDIUM). Update to version 3.40 or later; no in-the-wild exploitation reported. See: https://patchstack.com/dat...
CVE-2026-66601 WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...
EUVD-2026-63337
Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...
CVE-2026-66594 WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability
Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...
CVE-2026-66594
The WordPress Persistent Login plugin (versions ≤ 3.1.0) has a subscriber-level SQL injection vulnerability exploitable over the network with low privileges. CVSS 8.5 (HIGH) reflects high confidentiality impact and low availability impact. No in-the-wild exploitation is reported. Upgrade to a ver...
WordPress Wired Impact Volunteer Management plugin < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp vulnerability
Subscriber+ Arbitrary RSVP Removal via wivmremoversvp vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Wired Impact Volunteer Management versions 2.8.2...
PT-2026-78990
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
PT-2026-78989
Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...
PT-2026-78991
Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...
CVE-2026-66668
Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...
CVE-2026-32552
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
EUVD-2026-62376
Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...
CVE-2026-66668
CVE-2026-66668 is a Subscriber SQL Injection vulnerability in the Community by PeepSo WordPress plugin, affecting versions ≤ 9.0.5.2 . The vulnerability was discovered by Yukusawa18 and reported via Patchstack. The CVSS 3.1 base score is 8.5 (HIGH) , with a network attack vector, low complexity, ...