CVE-2026-107887

The Advanced Twenty Seventeen WordPress plugin, affecting versions through 1.3.1 , contains a vulnerability due to the lack of capability or nonce checks on the action that creates and activates its bundled child theme. This allows any authenticated user, such as a subscriber , to switch the site...

EUVD-2026-109231

The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be...

CVE-2026-107887 Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme

The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be...

CVE-2026-107887 Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme

The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be...

WordPress Advanced Twenty Seventeen plugin <= 1.3.1 - Subscriber+ Site Theme Switch vulnerability

Subscriber+ Site Theme Switch vulnerability discovered by Seongwon LEE in WordPress Plugin Advanced Twenty Seventeen versions = 1.3.1...

PT-2026-122498

The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be...

EUVD-2022-52014

Malicious code in bioql PyPI...

CVE-2022-4702

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wprfixroyalcompatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to deactivate every plugin on...