TI-2026-68301 CVE-2026-105058 · GHSA-7qfw-cm5p-qpvw
Privilege escalation in WordPress WP User Profiles plugin
Priority MEDIUM 40
Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
John James Jacoby
Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
John James Jacoby records in CISA KEVNo John James Jacoby vulnerabilities are listed in CISA KEV.
Records
9 records
TI-2025-22687 CVE-2025-31524 · GHSA-fjrr-5cxp-m5h2
WordPress WP User Profiles plugin <= 2.6.2 - Privilege Escalation vulnerability
Priority MEDIUM 40
Incorrect Privilege Assignment vulnerability in John James Jacoby WP User Profiles wp-users-profiles allows Privilege Escalation.This issue affects WP User Profiles: from n/a through <= 2.6.2.
TI-2026-52000 CVE-2026-74010 · GHSA-5f39-f66q-w7v7
WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability
Priority LOW 30
Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels.
TI-2026-44396 CVE-2026-62137 · GHSA-365v-89rm-vvfv
WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability
Priority LOW 30
Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.
TI-2025-04100 CVE-2025-4587 · GHSA-mjxw-8gwp-4j3h
A/B Testing for WordPress <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Priority LOW 28
The A/B Testing for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ab-testing-for-wp/ab-test-block' block in all versions up to, and including, 1.18.2 due to insufficient in…
TI-2025-01235 CVE-2025-1435 · GHSA-3frh-5xx6-qrgx
bbPress <= 2.6.11 - Cross-Site Request Forgery to Limited Privilege Escalation
Priority LOW 27
The bbPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.11.
TI-2025-11493 CVE-2025-12524
Post Type Switcher <= 4.0.0 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change
Priority LOW 24
The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a user controlled key.
TI-2026-19782 CVE-2026-24542 · GHSA-vgxm-x435-rmh6
WordPress WP Term Order plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability
Priority LOW 19
Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Term Order wp-term-order allows Cross Site Request Forgery.This issue affects WP Term Order: from n/a through <= 2.1.0.
TI-2025-37500 CVE-2025-60134 · GHSA-qxjc-jq8g-2v36
WordPress WP Media Categories Plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability
Priority LOW 19
Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery.This issue affects WP Media Categories: from n/a through <= 2.1.0.