Vulnerabilities

TI-2026-68301 CVE-2026-105058 · GHSA-7qfw-cm5p-qpvw

Privilege escalation in WordPress WP User Profiles plugin

MEDIUM 40

Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00306 Published 2026-10-06 No fix listed CWE-266

TI-2026-44396 CVE-2026-62137 · GHSA-365v-89rm-vvfv

WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability

LOW 30

Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00313 Published 2026-09-11 No fix listed CWE-862

TI-2026-52000 CVE-2026-74010 · GHSA-5f39-f66q-w7v7

WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00314 Published 2026-08-31 No fix listed CWE-862

TI-2026-19782 CVE-2026-24542 · GHSA-vgxm-x435-rmh6

WordPress WP Term Order plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Term Order wp-term-order allows Cross Site Request Forgery.This issue affects WP Term Order: from n/a through <= 2.1.0.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00151 Published 2026-01-23 No fix listed CWE-352

TI-2025-11493 CVE-2025-12524

Post Type Switcher <= 4.0.0 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change

LOW 24

The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a user controlled key.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00306 Published 2025-11-18 No fix listed CWE-639

TI-2025-37500 CVE-2025-60134 · GHSA-qxjc-jq8g-2v36

WordPress WP Media Categories Plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery.This issue affects WP Media Categories: from n/a through <= 2.1.0.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0014 Published 2025-10-22 No fix listed CWE-352

TI-2025-04100 CVE-2025-4587 · GHSA-mjxw-8gwp-4j3h

A/B Testing for WordPress <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The A/B Testing for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ab-testing-for-wp/ab-test-block' block in all versions up to, and including, 1.18.2 due to insufficient in…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00218 Published 2025-06-27 No fix listed CWE-79

TI-2025-22687 CVE-2025-31524 · GHSA-fjrr-5cxp-m5h2

WordPress WP User Profiles plugin <= 2.6.2 - Privilege Escalation vulnerability

MEDIUM 40

Incorrect Privilege Assignment vulnerability in John James Jacoby WP User Profiles wp-users-profiles allows Privilege Escalation.This issue affects WP User Profiles: from n/a through <= 2.6.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00399 Published 2025-04-10 No fix listed CWE-266

TI-2025-01235 CVE-2025-1435 · GHSA-3frh-5xx6-qrgx

bbPress <= 2.6.11 - Cross-Site Request Forgery to Limited Privilege Escalation

LOW 27

The bbPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.11.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00197 Published 2025-03-05 No fix listed CWE-352

Vulnerabilities

Filters