4993 matches found
EUVD-2026-125984
The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and attach a payment method of their choosi...
WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server. id:...
WordPress Bit File Manager < 6.9.1 - Arbitrary File Read
The Bit File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory. id: CVE-2026-17540 info: name: WordPress Bit File...
CVE-2023-2916
CVE-2023-2916 CVE-2023-2916 PoC The InfiniteWP Client plugin for WordPress, in versions up to and including 1.11.1, is vulnerable to a Sensitive Information Exposure flaw. This vulnerability allows authenticated attackers with subscriber-level permissions or above to extract sensitive data,...
CVE-2023-6985
CVE-2023-6985 10Web AI Assistant – AI content writing assistant = 1.0.18 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description Description The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized...
CVE-2024-12558
CVE-2024-12558 WP BASE Booking of Appointments, Services and Events history.pushState'', '', '/'; document.forms0.submit;...
CVE-2023-47840
CVE-2023-47840 Qode Essential Addons = 1.5.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The Qode Essential Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...
CVE-2026-120687
The Lightbox & Modal Popup WordPress Plugin (FooBox) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in versions up to and including 2.8.7 . The flaw stems from insufficient input sanitization and output escaping of the img alt attribute within .wp-caption containers . This allows un...
EUVD-2026-125938
The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escapin...
EUVD-2026-125937
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fvplayervideos' parameter in all versions up to, and including, 8.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-110531
The FV Player 8 plugin for WordPress (versions up to and including 8.1.9 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the fv_player_videos parameter due to insufficient input sanitization and output escaping. An authenticated attacker with Subscriber-level access or h...
CVE-2026-18053
The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the useraccountmanager function's editprofile branch, where all submitted $POST fields are iterated and directly assigned to the...
EUVD-2026-125905
The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the useraccountmanager function's editprofile branch, where all submitted $POST fields are iterated and directly assigned to the...
CVE-2024-54379
CVE-2024-54379 Minterpress = 1.0.5 - Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update Description The Minterpress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on a functio...
WordPress Countdown, Coming Soon, Maintenance plugin <= 3.0.8 - Subscriber+ Non-Public Post Title Disclosure vulnerability
Subscriber+ Non-Public Post Title Disclosure vulnerability discovered by Huseyn in WordPress Plugin Countdown & Clock versions = 3.0.8...
PT-2026-147425
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv player videos' parameter in all versions up to, and including, 8.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...
PT-2026-147420
Name of the Vulnerable Software and Affected Versions MemberDash versions prior to 1.8.8 Description An issue exists in the user account manager function's edit profile branch. A mass-assignment flaw occurs when submitted $ POST fields are iterated and assigned to the current member object via th...
CVE-2026-18053: LearnDash MemberDash: The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7
The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the useraccountmanager function's editprofile branch, where all submitted $POST fields are iterated and directly assigned to the...
PT-2026-147427
The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escapin...