Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-18943

WPC Admin Columns < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Admincolumns Wordpress
Products
Admin Columns Wordpress
CVE-2026-18962

WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wp Photo Album Plus Project
Products
Wordpress Wp Photo Album Plus
CVE-2026-19050

ProSolution WP Client < 2.0.9 - Subscriber+ SSRF via proSol_url_validate

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary requests to internal hosts and services, including requests with an attacker-chosen method, headers and body.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Prosolution Wordpress
Products
Prosolution Wp Client Wordpress
CVE-2026-19052

ProSolution WP Client < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the ProSolution WP Client WordPress plugin before 2.0.9's activity records.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Prosolution Wordpress
Products
Prosolution Wp Client Wordpress
CVE-2026-61965

WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ahmad Wordpress
Products
Geekybot Wordpress
CVE-2026-61967

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress
Products
Otp Verification Wordpress
CVE-2026-66456

WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bestwebsoft Wordpress
Products
Profile Extra Fields Wordpress