Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8.Apr 17, 2026
- Medium5.3The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2.Apr 17, 2026
- Medium6.5The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of on user-controlled input in the method of in all versions up…Apr 17, 2026
- Medium6.5The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4.Apr 17, 2026
- Medium5.9Note Mark is an open-source note-taking application.Apr 17, 2026
- Low3.1The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.8.0.Apr 16, 2026
- Medium5.3The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa…EPSS 0.3%Apr 16, 2026
- High8.8The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on…Apr 16, 2026
- Critical9.8The Riaxe Product Customizer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.2.Apr 16, 2026
- Medium5.3The Riaxe Product Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.2.Apr 16, 2026
- Medium5.3The Basic Google Maps Placemarks plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.10.7.Apr 16, 2026
- High8.7OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative com…Apr 16, 2026
- Medium4.3The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Missing…Apr 15, 2026
- Medium4.3Weblate is a web based localization tool.Apr 15, 2026
- High7.5Missing Authorization vulnerability in Plisio Accept Cryptocurrencies with Plisio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af…Apr 15, 2026
- Critical9.3The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administ…Apr 15, 2026
- Medium4.3Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect…Apr 15, 2026
- Medium5.3Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This…Apr 15, 2026
- Medium5.3Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.T…Apr 15, 2026
- Medium5.3Missing Authorization vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Exploiting Incorrectly Configured Access Control Security Levels.This is…Apr 15, 2026
- Medium5.4Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: fr…Apr 15, 2026
- Medium5.3Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Le…Apr 15, 2026
- Medium4.3Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issu…Apr 15, 2026
- Medium4.3Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe…Apr 15, 2026
- Low2.7Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server c…Apr 15, 2026