Vulnerabilities

TI-2026-75198 CVE-2026-85659 · GHSA-ph8g-mcqh-5p98

Privilege escalation in PilotPress lets members take over admin accounts

MEDIUM 40

The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00356 Published 2026-10-16 No fix listed CWE-269

TI-2025-36026 CVE-2025-58221 · GHSA-pw36-hxw6-v2x3

WordPress PilotPress Plugin <= 2.0.36 - Broken Access Control Vulnerability

LOW 20

Missing Authorization vulnerability in ONTRAPORT PilotPress pilotpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PilotPress: from n/a through <= 2.0.36.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00241 Published 2025-09-22 No fix listed CWE-862

TI-2025-36043 CVE-2025-58238 · GHSA-j586-6pff-v83x

WordPress PilotPress Plugin <= 2.0.36 - Cross Site Scripting (XSS) Vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ONTRAPORT PilotPress pilotpress allows Stored XSS.This issue affects PilotPress: from n/a through <= 2.0.36.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00283 Published 2025-09-22 No fix listed CWE-79

TI-2024-15565 CVE-2024-23524 · GHSA-jh62-vvqv-2m3p

WordPress PilotPress plugin <= 2.0.30 - Broken Access Control vulnerability

LOW 38

Missing Authorization vulnerability in ONTRAPORT Inc.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00307 Published 2024-06-10 No fix listed CWE-862

TI-2017-14735 CVE-2017-1002010 · GHSA-qmjg-fj6g-53mc

SQL injection in ONTRAPORT Membership Simplified

MEDIUM 46

Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02277 Published 2017-09-14 Fixed in 1.58 CWE-89

TI-2017-14734 CVE-2017-1002009 · GHSA-92r5-7cvr-68j4

Vulnerability in wordpress plugin Membership Simplified v1.58, The code in…