9735 matches found
CVE-2026-16039
CVE-2026-16039 affects the MStore API WordPress plugin prior to 4.21.0. The vendor-orders endpoint does not restrict access to the caller’s orders, allowing any authenticated user (including Subscribers) to read every WooCommerce order and associated customer personal information. Root cause: imp...
CVE-2026-11907
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...
CVE-2026-11907 Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...
EUVD-2026-54366
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...
CVE-2026-11907
CVE-2026-11907 concerns the WordPress Stream plugin (
CVE-2026-14306
The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content...
CVE-2026-14306 Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass
The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content...
CVE-2026-14306
CVE-2026-14306 affects Tutor LMS for WordPress, prior to version 3.9.14. The vulnerability is an enrollment check bypass that allows authenticated users with subscriber-level access (or higher) who are enrolled in at least one course to view paid lesson, quiz, and assignment content from other co...
CVE-2026-66711
Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...
CVE-2026-65569
Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...
CVE-2026-65552
Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...
CVE-2026-65554
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions...
CVE-2026-65543
Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...
CVE-2026-65547
Subscriber SQL Injection in Creative Mail = 1.6.9 versions...
CVE-2026-66711
Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...
EUVD-2026-53887
Subscriber Broken Access Control in Frontend Admin by DynamiApps = 3.29.10 versions...
EUVD-2026-53987
Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...
CVE-2026-65569
CVE-2026-65569 affects the WordPress WP Job Portal plugin