Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators. id: CVE-2025-4334 info: name: Simple User Registration = 6.3 -...

Astra Linux – Vulnerability in edk2

Improper configuration in the system firmware for EDK II may allow unauthenticated users to potentially enable privilege escalation, information disclosure, and/or denial of service through local access...

CVE-2026-18322 Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator

The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the havePermissions function in classes/frame.php, where arraymerge overwrites the popup module's...

CVE-2026-18322

The Smart Popup by Supsystic WordPress plugin (versions ↜ 1.13.0 ) is vulnerable to unauthenticated privilege escalation leading to the creation of a persistent Administrator account. The root cause is a permission map collision in the havePermissions() function within classes/frame.php, where ar...

CVE-2026-15988

The CVE refers to the WordPress plugin “AI Engine – The Chatbot, AI Framework & MCP for WordPress.” All versions up to and including 3.6.5 are affected by a CSRF vulnerability due to missing or incorrect nonce validation in reauth_for_authorize. This enables unauthenticated attackers to create ne...

CVE-2026-11961 User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID

The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into ...

Exploit for CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 Unauthenticated Pr...

WordPress Eventer plugin <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation vulnerability

Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin Eventer versions = 4.4.2...

CVE-2026-14482

The CVE-2026-14482 entry covers the WordPress plugin “多说社会化评论框” (

WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.5 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by ? in WordPress Plugin SMS Alert Order Notifications versions = 3.9.5...

CVE-2026-11387 SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updati...

Security Bulletin: This PowerVM Novalink update is being released to address CVE-2026-12943

Summary A vulnerability on PowerVM Novalink could allow an unauthenticated attacker to gain elevated privileges and execute arbitrary commands. PowerVM Novalink has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2026-12943 DESCRIPTION: Management systems in IBM Power environments H...

CVE-2026-12073 ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a userlogin on registration forms that don't contain this parameter, and...

CVE-2026-56033

Unauthenticated Privilege Escalation in Dokan Pro = 5.0.4 versions...

CVE-2026-56028

CVE-2026-56028 describes an unauthenticated privilege-escalation vulnerability in the WordPress plugin Easy Elements for Elementor – Addons & Website Templates (versions

PT-2026-52744

Name of the Vulnerable Software and Affected Versions Easy Elements for Elementor – Addons & Website Templates versions prior to 1.5.0 Description An unauthenticated privilege escalation issue exists, allowing an attacker to gain higher-level permissions without providing valid credentials...

CVE-2026-54807 WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Registration Form for WooCommerce = 1.0.9 versions...

CVE-2026-49063 WordPress Listdom plugin <= 5.5.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Listdom = 5.5.0 versions...

CVE-2026-39587 WordPress WP BASE Booking plugin <= 5.9.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in WP BASE Booking = 5.9.0 versions...

CVE-2026-53408

The CVE-2026-53408 vulnerability affects Zoom Workplace: Android before 7.0.4 and iOS before 7.0.3. It is due to Improper Authorization in the Handler for a Custom URL Scheme, enabling an unauthenticated privilege escalation via network access. The CVSSv3.1 base score is 8.1 (High) with Network a...