PT-2026-49397

Subscriber Arbitrary File Upload in WpStream 4.11.2 versions...

PT-2026-49344

Name of the Vulnerable Software and Affected Versions FV Flowplayer Video Player versions prior to 7.5.51.7212 Description Cross Site Scripting XSS is possible for users with the Subscriber role. This issue allows an attacker to inject malicious scripts into web pages viewed by other users...

PT-2026-49484

Name of the Vulnerable Software and Affected Versions Visual Link Preview versions prior to 2.4.2 Description An issue in the plugin leads to the exposure of sensitive subscriber data. Recommendations Update to version 2.4.2 or later...

PT-2026-49523

Subscriber SQL Injection in WCMultiShipping = 3.0.2 versions...

PT-2026-49445

Subscriber Broken Access Control in Classified Listing = 5.3.9 versions...

PT-2026-49436

Subscriber Cross Site Scripting XSS in ProfilePress = 4.16.13 versions...

PT-2026-49451

Subscriber Sensitive Data Exposure in Contest Gallery = 28.1.7 versions...

PT-2026-49353

Subscriber Broken Access Control in Bookify = 1.1.1 versions...

PT-2026-49450

Subscriber Broken Access Control in Advanced Form Integration = 1.126.12 versions...

PT-2026-49349

Subscriber Broken Access Control in bunny.net = 2.3.6 versions...

PT-2026-49227

Name of the Vulnerable Software and Affected Versions Really Simple SSL versions prior to 9.6.0 Description Broken Access Control allows users with the Subscriber role to perform unauthorized actions. Recommendations Update to a version newer than 9.5.9...

PT-2026-49404

Subscriber Arbitrary File Upload in WP-BusinessDirectory = 4.0.0 versions...

PT-2026-49405

Subscriber Broken Access Control in Ultra Addons for WPForms = 1.0.11 versions...

WordPress WP Maps plugin < 4.9.3 - Subscriber+ Local File Inclusion vulnerability

Subscriber+ Local File Inclusion vulnerability discovered by Mustafa Ahmed in WordPress Plugin WP Maps versions 4.9.3...

WordPress Restaurant Cafeteria theme <= 0.4.6 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability

Subscriber+ Arbitrary Plugin Installation/Activation vulnerability discovered by Khaled Alenazi Nxploited in WordPress Theme Restaurant Cafeteria versions = 0.4.6...

CVE-2026-4058

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the usersubscriptioncancel function in all versions up to, and including, 4.3.2. Thi...

WordPress WP GDPR Cookie Consent plugin <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin WP GDPR Cookie Consent versions = 1.0.0...

WordPress Advanced Google reCAPTCHA plugin <= 5.38 - Authenticated (Subscriber+) Authentication Bypass vulnerability

Authenticated Subscriber+ Authentication Bypass vulnerability discovered by Nguyen Ngoc Duc duc193 in WordPress Plugin Advanced Google reCAPTCHA versions = 5.38...

CVE-2026-4058 User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the usersubscriptioncancel function in all versions up to, and including, 4.3.2. Thi...

CVE-2026-4058

The CVE-2026-4058 entry concerns the WordPress plugin “User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration”. A missing capability check in user_subscription_cancel() across all versions up to 4.3.2 allows authenticated users with Subscriber-level ac...