CVE-2026-27364 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

CVE-2026-28190

Subscriber Broken Access Control in ProLancer Element = 1.4.8 versions...

EUVD-2026-64802

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

CVE-2026-32478 WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

CVE-2026-32471

ProLancer Element is a WordPress plugin affected by a subscriber-level SQL injection vulnerability in versions 1.4.8 and below . An authenticated subscriber (low privilege) can exploit this remotely over the network with low complexity and no user interaction. The CVSS 3.1 score is 8.5 (HIGH) , w...

CVE-2026-32471 WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability

Subscriber SQL Injection in ProLancer Element = 1.4.8 versions...

CVE-2026-28190

CVE-2026-28190 is a Broken Access Control vulnerability in the ProLancer Element WordPress plugin, affecting versions 1.4.8 and earlier . The flaw allows users with the Subscriber role to perform actions beyond their intended privilege level, resulting in primarily integrity impact and minor avai...

CVE-2026-78278

Fluent Boards Pro is a WordPress plugin affected by a Subscriber-level Insecure Direct Object Reference (IDOR) vulnerability in versions ≤ 2.0.11 . The flaw is reachable over the network with no privileges required and low attack complexity , allowing an unauthenticated attacker to access objects...

CVE-2026-78277 WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in FluentCRM Pro = 3.1.12 versions...

CVE-2026-78278 WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

PT-2026-81050

Name of the Vulnerable Software and Affected Versions MagicAI for WordPress versions 1.4 and earlier Description A Local File Inclusion issue exists that allows users with Subscriber privileges to read arbitrary files on the server. Recommendations Update MagicAI for WordPress to a version later...

PT-2026-81045

Name of the Vulnerable Software and Affected Versions Style Kits versions prior to 2.6.6 Description Broken Access Control allows a user with Subscriber privileges to perform unauthorized actions. Recommendations Update Style Kits to version 2.6.6 or later...

PT-2026-81049

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-77116

Brave Popup Builder (WordPress plugin, slug: brave-popup-builder) versions through 0.8.5 contain a broken access control vulnerability. Any authenticated user with a low-privilege role (Subscriber or WooCommerce Customer) can read unpublished popup content by passing a post ID in the URL, effecti...

CVE-2026-77116 Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-14853 WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

EUVD-2026-64606

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the getimagesrcinbase64 function. This makes it possible for authenticated attackers, with...

CVE-2026-18027

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.9.8 . The flaw resides in the get_image_src_in_base64 function, which processes the customer_note parameter witho...

CVE-2026-76057

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

EUVD-2026-64209

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...