CVE-2026-14306 Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content...

CVE-2026-14306

CVE-2026-14306 affects Tutor LMS for WordPress, prior to version 3.9.14. The vulnerability is an enrollment check bypass that allows authenticated users with subscriber-level access (or higher) who are enrolled in at least one course to view paid lesson, quiz, and assignment content from other co...

CVE-2026-66711

Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...

CVE-2026-65569

Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...

CVE-2026-65552

Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...

CVE-2026-65554

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions...

CVE-2026-65543

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

CVE-2026-65547

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

CVE-2026-66711

Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...

EUVD-2026-53887

Subscriber Broken Access Control in Frontend Admin by DynamiApps = 3.29.10 versions...

EUVD-2026-53987

Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...

CVE-2026-65569

CVE-2026-65569 affects the WordPress WP Job Portal plugin

EUVD-2026-53982

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions...

CVE-2026-65552

CVE-2026-65552 concerns the WordPress Export User Data plugin (versions

EUVD-2026-53980

Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...

CVE-2026-65547 WordPress Creative Mail plugin <= 1.6.9 - SQL Injection vulnerability

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

EUVD-2026-53977

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

CVE-2026-65543

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

CVE-2026-65543 WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

CVE-2026-65543

CVE-2026-65543 affects the WordPress Vimeo plugin (versions ≤ 1.2.2). The vulnerability is described as Subscriber Sensitive Data Exposure, with CVSS v3.1 Base Score 7.5 (HIGH) and an attack vector of NETWORK, requiring no privileges and no user interaction. The root cause and affected components...