PT-2026-71528

Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...

PT-2026-71546

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

PT-2026-71519

Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...

PT-2026-71515

Subscriber SQL Injection in Do Lasso = 358 versions...

PT-2026-71563

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

PT-2026-71576

Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...

PT-2026-71527

Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...

PT-2026-71557

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

PT-2026-71498

Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...

PT-2026-71526

Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...

PT-2026-71505

Subscriber Broken Access Control in Tourfic = 2.23.1 versions...

PT-2026-71586

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

PT-2026-71566

Subscriber Cross Site Scripting XSS in AfterShip Tracking = 1.18.1 versions...

PT-2026-71520

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

PT-2026-71516

Subscriber Path Traversal in Do Lasso = 358 versions...

PT-2026-71518

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-19052

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation a...

CVE-2026-18962

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

CVE-2026-18230

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks...

CVE-2026-18057

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people...