9686 matches found
CVE-2026-15001
CVE-2026-15001 affects the bLoyal: Loyalty & Promotions WordPress plugin (versions up to 3.1.611.78). The root cause is unprotected AJAX actions—save_bloyal_configuration_data and save_bloyal_accesskeyverification_data—registered without capability or nonce checks, combined with bloyal_customer_a...
EUVD-2026-58841
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...
CVE-2026-15001
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...
CVE-2026-15001 bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...
PT-2026-72150
Name of the Vulnerable Software and Affected Versions Cookie Banner for GDPR / CCPA – WPLP Cookie Consent versions prior to 4.3.6 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrar...
PT-2026-72879
Name of the Vulnerable Software and Affected Versions Real Estate Manager Pro versions prior to 12.8.7 Description Improper capability handling in the allow attachment actions function allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to...
PT-2026-72153
Name of the Vulnerable Software and Affected Versions Form Maker by 10Web versions prior to 1.15.45 Description An issue exists where authenticated attackers with subscriber-level access or higher can perform blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameter...
WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls vulnerability
Subscriber+ proSolajaxTablesync and proSolajaxClearlog Calls vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...
WordPress WP Photo Album Plus plugin < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability
Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability discovered by Farid Narimanov in WordPress Plugin WP Photo Album Plus versions 9.2.09.002...
CVE-2026-66693
Subscriber Broken Access Control in Motors = 1.4.113 versions...
CVE-2026-66661
Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...
CVE-2026-66658
Subscriber SQL Injection in Reviewer = 3.14.2 versions...
CVE-2026-66654
Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...
CVE-2026-66467
Subscriber Cross Site Scripting XSS in FluentCommunity = 2.7.5 versions...
CVE-2026-66471
Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...
CVE-2026-66460
Subscriber Cross Site Scripting XSS in AfterShip Tracking = 1.18.1 versions...
CVE-2026-66456
Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...
CVE-2026-66455
Subscriber Broken Access Control in ReactPress = 3.4.0 versions...