CVE-2026-88999

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-88999 Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-90501

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

PT-2026-98394

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and...

CVE-2026-13250: Missing Authorization

The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete all...

CVE-2018-5651: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php darkmodestart parameter...

CVE-2018-5652: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php darkmodeend parameter...

PT-2018-17050

Name of the Vulnerable Software and Affected Versions dark-mode plugin version 1.6 Description A security issue was found in the dark-mode plugin for WordPress, where cross-site scripting XSS exists via the dark mode start parameter in the "wp-admin/profile.php" API endpoint. Recommendations For...

PT-2018-17051

Name of the Vulnerable Software and Affected Versions dark-mode plugin version 1.6 Description A security issue was found in the dark-mode plugin for WordPress, where cross-site scripting XSS exists. This is due to the dark mode end parameter in the "wp-admin/profile.php" endpoint. Recommendation...

CVE-2018-5214

The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fbfacebookid parameter to wp-admin/profile.php...

CVE-2018-5214: Improper Neutralization of Input During Web Page Generation

The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fbfacebookid parameter to wp-admin/profile.php...

PT-2018-16806

Name of the Vulnerable Software and Affected Versions Add Link to Facebook plugin versions prior to 2.3 Description The issue allows for XSS via the al2fb facebook id parameter to the "wp-admin/profile.php" endpoint. Recommendations For Add Link to Facebook plugin versions prior to 2.3, update to...