CVE-2026-65543

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

CVE-2026-65543 WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

CVE-2026-65543

CVE-2026-65543 affects the WordPress Vimeo plugin (versions ≤ 1.2.2). The vulnerability is described as Subscriber Sensitive Data Exposure, with CVSS v3.1 Base Score 7.5 (HIGH) and an attack vector of NETWORK, requiring no privileges and no user interaction. The root cause and affected components...

EUVD-2026-53973

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

CVE-2026-61959

The CVE-2026-61959 entry concerns a Cross Site Scripting (XSS) vulnerability in the WordPress Business Directory plugin, affecting versions

EUVD-2026-53956

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...

CVE-2026-18501

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

EUVD-2026-53926

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

CVE-2026-18501

The CVE concerns the UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress. It is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to and including 1.2.69, caused by insufficient input sanitizati...

CVE-2025-9266

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...

CVE-2025-9266 Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...

CVE-2025-9266

CVE-2025-9266 affects the WordPress Accelerate theme up to version 1.5.3. The root cause is a missing capability check in enqueue_scripts(), enabling authenticated users with Subscriber-level access and above to install and activate the ThemeGrill Demo Importer plugin. The impact is unauthorized ...

EUVD-2025-210641

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to instal...

WordPress File Manager plugin 6.0-6.9 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion vulnerability

WordPress File Manager plugin 6.0-6.9 - 6.9 - Missing Authorization to Authenticated Subscriber+ Arbitrary File Read and Deletion vulnerability discovered by daroo in WordPress Plugin Bit File Manager versions 6.0-6.9...

CVE-2026-13703

The CVE-2026-13703 entry concerns the SEO Redirection Plugin for WordPress, vulnerable before version 9.19. The issue is that one authenticated AJAX action does not perform a capability check, enabling any logged-in user (e.g., a subscriber) to read the site’s configured 301 redirect rules, inclu...

CVE-2026-13703

The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in user such as a subscriber to read the site's configured 301 redirect rules, including their source and destination URLs...

CVE-2026-13703 SEO Redirection Plugin – 301 Redirect Manager < 9.19 - Subscriber+ Redirect Rule Disclosure

The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in user such as a subscriber to read the site's configured 301 redirect rules, including their source and destination URLs...

CVE-2026-15991 File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

CVE-2026-15991

The File Manager WordPress plugin (versions 6.0–6.9) is affected by an access control flaw in its elFinder integration. Insufficient file path validation in the connector allows an authenticated user with subscriber-level access or higher to read and delete arbitrary server files via a cmd parame...

CVE-2026-7456

The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...