Vulnerabilities

TI-2026-16125 CVE-2026-19892 · GHSA-4528-gx3q-g73r

InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure

MEDIUM 40

The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00442 Published 2026-08-25 No fix listed CWE-862

TI-2026-05708 CVE-2026-6512 · GHSA-r6vp-gccc-x4j6

MEDIUM 45

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00264 Published 2026-05-14 No fix listed CWE-862

TI-2026-05709 CVE-2026-6514 · GHSA-mh5f-f33c-v7q4

LOW 38

The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00271 Published 2026-05-14 No fix listed CWE-918

TI-2026-05702 CVE-2026-6506 · GHSA-46r5-fg25-pxgj

MEDIUM 40

The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0029 Published 2026-05-14 No fix listed CWE-862

TI-2026-05706 CVE-2026-6510 · GHSA-jp9r-75g3-6qxr

MEDIUM 49

The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00439 Published 2026-05-14 No fix listed CWE-862