GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria

    10908 vulnerabilities by unknown

    CVE-2026-92965 (GCVE-0-2026-92965)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption
    Summary
    The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code loosely, so URLs that merely resemble the expected one trigger it too, and the callback runs on every request to the site rather than only on the administrator's sign-in.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/e74a467a-9eb1-4d… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown TikTok Affected: 1.2.0 , < 1.4.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "TikTok",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "1.4.2",
                  "status": "affected",
                  "version": "1.2.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "RIA Labs"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site\u0027s own credentials. It matches that code loosely, so URLs that merely resemble the expected one trigger it too, and the callback runs on every request to the site rather than only on the administrator\u0027s sign-in."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-862 Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:18.907Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/e74a467a-9eb1-4da3-933a-879c9c026f4f/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-92965",
        "datePublished": "2026-09-20T06:00:18.907Z",
        "dateReserved": "2026-09-17T13:04:15.928Z",
        "dateUpdated": "2026-09-20T06:00:18.907Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-92541 (GCVE-0-2026-92541)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer
    Summary
    The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/b31fb9ee-9f65-43… exploitvdb-entrytechnical-description
    Impacted products
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Import and export users and customers",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "2.5.2",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "BINESH MADHARAPU"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-269 Improper Privilege Management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:18.739Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/b31fb9ee-9f65-43d0-88fa-da99513f8a3b/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Import and export users and customers \u003c 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-92541",
        "datePublished": "2026-09-20T06:00:18.739Z",
        "dateReserved": "2026-09-16T12:58:16.942Z",
        "dateUpdated": "2026-09-20T06:00:18.739Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-92540 (GCVE-0-2026-92540)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users
    Summary
    The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/3a112d4b-9824-41… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Import and export users and customers Affected: 2.4.16 , < 2.5.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Import and export users and customers",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "2.5.2",
                  "status": "affected",
                  "version": "2.4.16",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "yzx001"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-269 Improper Privilege Management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:18.572Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/3a112d4b-9824-4128-ad6a-25b928e6fbdd/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Import and export users and customers \u003c 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-92540",
        "datePublished": "2026-09-20T06:00:18.572Z",
        "dateReserved": "2026-09-16T12:58:12.152Z",
        "dateUpdated": "2026-09-20T06:00:18.572Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-92423 (GCVE-0-2026-92423)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts
    Summary
    The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/03bd9795-8036-4e… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Meow Gallery Affected: 0 , < 5.5.5 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Meow Gallery",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "5.5.5",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Kaan \u00d6zbek"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user\u0027s own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users\u0027 draft and private posts."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-200 Information Exposure",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:18.400Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/03bd9795-8036-4ec9-ab11-8dc2059d4245/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Meow Gallery \u003c 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-92423",
        "datePublished": "2026-09-20T06:00:18.400Z",
        "dateReserved": "2026-09-16T09:59:30.597Z",
        "dateUpdated": "2026-09-20T06:00:18.400Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-92422 (GCVE-0-2026-92422)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Meow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route
    Summary
    The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/17a94434-3ccc-42… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Meow Gallery Affected: 0 , < 5.5.5 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Meow Gallery",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "5.5.5",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "JunHee CHO"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-345 Insufficient Verification of Data Authenticity",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:18.231Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/17a94434-3ccc-4282-99f5-d18043673669/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Meow Gallery \u003c 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-92422",
        "datePublished": "2026-09-20T06:00:18.231Z",
        "dateReserved": "2026-09-16T09:59:23.399Z",
        "dateUpdated": "2026-09-20T06:00:18.231Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-92410 (GCVE-0-2026-92410)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF
    Summary
    The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/4c217ac6-e191-4b… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Sign-up Sheets Affected: 0 , < 2.4.0 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Sign-up Sheets",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "2.4.0",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "JunHee CHO"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:18.055Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/4c217ac6-e191-4be9-becc-47cacf2b4e25/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Sign-up Sheets \u003c 2.4.0 - Arbitrary Sign-up Deletion via CSRF",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-92410",
        "datePublished": "2026-09-20T06:00:18.055Z",
        "dateReserved": "2026-09-16T09:05:32.493Z",
        "dateUpdated": "2026-09-20T06:00:18.055Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-87840 (GCVE-0-2026-87840)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering
    Summary
    The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/7a81fd1d-9df5-45… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Tripzzy Affected: 1.3.4 , < 1.5.1 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Tripzzy",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "1.5.1",
                  "status": "affected",
                  "version": "1.3.4",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Pablo Gonz\u00e1lez P\u00e9rez"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Francisco Jos\u00e9 Ram\u00edrez Vicente and I\u00f1igo S\u00e1nchez Enciso"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Tripzzy  WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy  WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-284 Improper Access Control",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:17.845Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/7a81fd1d-9df5-4521-9a32-31fc9fe77960/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Tripzzy \u003c 1.5.1 - Unauthenticated Booking Data Tampering",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-87840",
        "datePublished": "2026-09-20T06:00:17.845Z",
        "dateReserved": "2026-09-09T11:22:38.094Z",
        "dateUpdated": "2026-09-20T06:00:17.845Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-87839 (GCVE-0-2026-87839)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion
    Summary
    The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/e5145602-cb5e-4e… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Tripzzy Affected: 1.1.8 , < 1.5.1 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Tripzzy",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "1.5.1",
                  "status": "affected",
                  "version": "1.1.8",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Pablo Gonz\u00e1lez P\u00e9rez"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Francisco Jos\u00e9 Ram\u00edrez Vicente and I\u00f1igo S\u00e1nchez Enciso"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Tripzzy  WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-284 Improper Access Control",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:17.654Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/e5145602-cb5e-4ef9-a51b-8f161200d014/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Tripzzy \u003c 1.5.1 - Unauthenticated Arbitrary Comment Deletion",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-87839",
        "datePublished": "2026-09-20T06:00:17.654Z",
        "dateReserved": "2026-09-09T11:22:36.182Z",
        "dateUpdated": "2026-09-20T06:00:17.654Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-87068 (GCVE-0-2026-87068)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import
    Summary
    The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/cc38d82b-a766-4d… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Forminator Forms Affected: 1.57.0 , < 1.57.2.1 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Forminator Forms",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "1.57.2.1",
                  "status": "affected",
                  "version": "1.57.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Karthik Ramakrishnan"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Forminator Forms  WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-269 Improper Privilege Management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:17.478Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/cc38d82b-a766-4da0-bf81-d9ba8fa9e51e/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Forminator Forms \u003c 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-87068",
        "datePublished": "2026-09-20T06:00:17.478Z",
        "dateReserved": "2026-09-08T19:02:31.821Z",
        "dateUpdated": "2026-09-20T06:00:17.478Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-87067 (GCVE-0-2026-87067)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection
    Summary
    The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/9f5da02e-55af-46… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Forminator Forms Affected: 1.57.0.7 , < 1.57.2.1 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Forminator Forms",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "1.57.2.1",
                  "status": "affected",
                  "version": "1.57.0.7",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Karthik Ramakrishnan"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Forminator Forms  WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms  WordPress plugin before 1.57.2.1\u0027s own settings, so the issue is reachable well below administrator on sites that use that feature."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:17.300Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/9f5da02e-55af-463f-8b1a-9fe792d589c4/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Forminator Forms \u003c 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-87067",
        "datePublished": "2026-09-20T06:00:17.300Z",
        "dateReserved": "2026-09-08T19:01:39.377Z",
        "dateUpdated": "2026-09-20T06:00:17.300Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-85017 (GCVE-0-2026-85017)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection
    Summary
    The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/459a7479-ebd8-4e… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Unlimited Elements For Elementor Affected: 0 , < 2.0.20 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Unlimited Elements For Elementor",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "2.0.20",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Jakub Herman"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-502 Deserialization of Untrusted Data",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:16.869Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/459a7479-ebd8-4e46-a709-cb86d0386f9b/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Unlimited Elements For Elementor \u003c 2.0.20 - Subscriber+ PHP Object Injection",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-85017",
        "datePublished": "2026-09-20T06:00:16.869Z",
        "dateReserved": "2026-09-02T19:18:51.316Z",
        "dateUpdated": "2026-09-20T06:00:16.869Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-84223 (GCVE-0-2026-84223)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
    Summary
    The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/02ed6d31-84f3-47… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Kirki Affected: 6.0.0 , < 6.3.1 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Kirki",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "6.3.1",
                  "status": "affected",
                  "version": "6.0.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Mohammed Abd Alrahman"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Kirki  WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site\u0027s own origin and runs in the session of anyone who opens it."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-79 Cross-Site Scripting (XSS)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:16.686Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/02ed6d31-84f3-4723-8b49-ddb00c7db7d3/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-84223",
        "datePublished": "2026-09-20T06:00:16.686Z",
        "dateReserved": "2026-09-01T11:50:32.830Z",
        "dateUpdated": "2026-09-20T06:00:16.686Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-82842 (GCVE-0-2026-82842)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching
    Summary
    The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/4ae66b2c-a0de-40… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown SAML Single Sign On Affected: 4.8.43 , < 6.0.0 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "SAML Single Sign On",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "6.0.0",
                  "status": "affected",
                  "version": "4.8.43",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Karthik Ramakrishnan"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The SAML Single Sign On  WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site\u0027s identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-269 Improper Privilege Management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:16.509Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/4ae66b2c-a0de-405f-baca-127302257540/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "SAML Single Sign On \u003c 6.0.0 - Unauthenticated Privilege Escalation via Account Matching",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-82842",
        "datePublished": "2026-09-20T06:00:16.509Z",
        "dateReserved": "2026-08-31T08:27:11.846Z",
        "dateUpdated": "2026-09-20T06:00:16.509Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-81654 (GCVE-0-2026-81654)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update
    Summary
    The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/bede7803-8ffd-4e… exploitvdb-entrytechnical-description
    Impacted products
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Photo Gallery, Sliders, Proofing and Themes",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "4.5.0",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Erwan LR (WPScan)"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Photo Gallery, Sliders, Proofing and   WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:16.342Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/bede7803-8ffd-4e17-852e-bce634466fcb/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "NextGEN Gallery \u003c 4.5.0 - Authenticated Plugin Image Settings Update",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-81654",
        "datePublished": "2026-09-20T06:00:16.342Z",
        "dateReserved": "2026-08-27T09:27:38.744Z",
        "dateUpdated": "2026-09-20T06:00:16.342Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-81653 (GCVE-0-2026-81653)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR
    Summary
    The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/0bceb61b-6986-46… exploitvdb-entrytechnical-description
    Impacted products
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Photo Gallery, Sliders, Proofing and Themes",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "4.5.0",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Erwan LR (WPScan)"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Photo Gallery, Sliders, Proofing and   WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:16.158Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/0bceb61b-6986-4669-896c-4279ecef0603/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "NextGEN Gallery \u003c 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-81653",
        "datePublished": "2026-09-20T06:00:16.158Z",
        "dateReserved": "2026-08-27T09:27:36.944Z",
        "dateUpdated": "2026-09-20T06:00:16.158Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-81652 (GCVE-0-2026-81652)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR
    Summary
    The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated read path reserves to administrators.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/58759289-adca-47… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Photo Gallery, Sliders, Proofing and Themes Affected: 3.59.5 , < 4.5.0 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Photo Gallery, Sliders, Proofing and Themes",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "4.5.0",
                  "status": "affected",
                  "version": "3.59.5",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Meher Sudhakar Abbireddi"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Photo Gallery, Sliders, Proofing and   WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image\u0027s stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and   WordPress plugin before 4.5.0\u0027s own capability-gated read path reserves to administrators."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:15.977Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/58759289-adca-47d5-8c15-c073c9f14c31/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "NextGEN Gallery \u003c 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-81652",
        "datePublished": "2026-09-20T06:00:15.977Z",
        "dateReserved": "2026-08-27T09:27:34.936Z",
        "dateUpdated": "2026-09-20T06:00:15.977Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-81651 (GCVE-0-2026-81651)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR
    Summary
    The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path, and including galleries belonging to other users.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/69ccebff-414d-49… exploitvdb-entrytechnical-description
    Impacted products
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Photo Gallery, Sliders, Proofing and Themes",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "4.5.0",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Murad Akhmedov"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Photo Gallery, Sliders, Proofing and   WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path, and including galleries belonging to other users."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:15.803Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/69ccebff-414d-49bb-b914-cae87ab27f4f/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "NextGEN Gallery \u003c 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-81651",
        "datePublished": "2026-09-20T06:00:15.803Z",
        "dateReserved": "2026-08-27T09:27:32.697Z",
        "dateUpdated": "2026-09-20T06:00:15.803Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-81650 (GCVE-0-2026-81650)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import
    Summary
    The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that execute them, run arbitrary code.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/7c1443ae-14b4-43… exploitvdb-entrytechnical-description
    Impacted products
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Photo Gallery, Sliders, Proofing and Themes",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "4.5.0",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Alihan \u015eahin"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Photo Gallery, Sliders, Proofing and   WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that execute them, run arbitrary code."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:15.631Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/7c1443ae-14b4-43ca-bb1a-b6a3f9b27c57/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "NextGEN Gallery \u003c 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-81650",
        "datePublished": "2026-09-20T06:00:15.631Z",
        "dateReserved": "2026-08-27T09:27:24.690Z",
        "dateUpdated": "2026-09-20T06:00:15.631Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16542 (GCVE-0-2026-16542)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar
    Summary
    The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/f57577b2-3031-43… exploitvdb-entrytechnical-description
    Impacted products
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Import and export users and customers",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "2.4.5",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Binesh Madharapu"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-918 Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:15.453Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/f57577b2-3031-433a-a3e1-758d12b244d1/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Import and export users and customers \u003c 2.4.5 - Admin+ SSRF via bp_avatar",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-16542",
        "datePublished": "2026-09-20T06:00:15.453Z",
        "dateReserved": "2026-07-22T09:43:42.454Z",
        "dateUpdated": "2026-09-20T06:00:15.453Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-14844 (GCVE-0-2026-14844)

    Vulnerability from nvd – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes
    Summary
    The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed. No fixed version is available. Until one ships, restrict the Contributor role to trusted users, or deactivate the Master Slider WordPress plugin through 3.11.2. Site owners who need to keep it active can block the ms_slider shortcode for roles below Editor, for example with a shortcode-restriction Master Slider WordPress plugin through 3.11.2, which prevents the attack without removing the Master Slider WordPress plugin through 3.11.2.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/06a5409c-3070-41… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Master Slider Affected: 0 , ≤ 3.11.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "product": "Master Slider",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThanOrEqual": "3.11.2",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "WEI HSIANG WANG"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Master Slider  WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed.\n\nNo fixed version is available. Until one ships, restrict the Contributor role to trusted users, or deactivate the Master Slider  WordPress plugin through 3.11.2. Site owners who need to keep it active can block the ms_slider shortcode for roles below Editor, for example with a shortcode-restriction Master Slider  WordPress plugin through 3.11.2, which prevents the attack without removing the Master Slider  WordPress plugin through 3.11.2."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-79 Cross-Site Scripting (XSS)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:15.268Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/06a5409c-3070-417f-98cb-0ca8ddbfe14c/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Master Slider \u003c= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-14844",
        "datePublished": "2026-09-20T06:00:15.268Z",
        "dateReserved": "2026-07-06T11:32:52.943Z",
        "dateUpdated": "2026-09-20T06:00:15.268Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-92965 (GCVE-0-2026-92965)

    Vulnerability from cvelistv5 – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption
    Summary
    The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code loosely, so URLs that merely resemble the expected one trigger it too, and the callback runs on every request to the site rather than only on the administrator's sign-in.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/e74a467a-9eb1-4d… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown TikTok Affected: 1.2.0 , < 1.4.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "TikTok",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "1.4.2",
                  "status": "affected",
                  "version": "1.2.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "RIA Labs"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site\u0027s own credentials. It matches that code loosely, so URLs that merely resemble the expected one trigger it too, and the callback runs on every request to the site rather than only on the administrator\u0027s sign-in."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-862 Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:18.907Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/e74a467a-9eb1-4da3-933a-879c9c026f4f/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-92965",
        "datePublished": "2026-09-20T06:00:18.907Z",
        "dateReserved": "2026-09-17T13:04:15.928Z",
        "dateUpdated": "2026-09-20T06:00:18.907Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-92541 (GCVE-0-2026-92541)

    Vulnerability from cvelistv5 – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer
    Summary
    The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/b31fb9ee-9f65-43… exploitvdb-entrytechnical-description
    Impacted products
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Import and export users and customers",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "2.5.2",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "BINESH MADHARAPU"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-269 Improper Privilege Management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:18.739Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/b31fb9ee-9f65-43d0-88fa-da99513f8a3b/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Import and export users and customers \u003c 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-92541",
        "datePublished": "2026-09-20T06:00:18.739Z",
        "dateReserved": "2026-09-16T12:58:16.942Z",
        "dateUpdated": "2026-09-20T06:00:18.739Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-92540 (GCVE-0-2026-92540)

    Vulnerability from cvelistv5 – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users
    Summary
    The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/3a112d4b-9824-41… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Import and export users and customers Affected: 2.4.16 , < 2.5.2 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Import and export users and customers",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "2.5.2",
                  "status": "affected",
                  "version": "2.4.16",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "yzx001"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-269 Improper Privilege Management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:18.572Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/3a112d4b-9824-4128-ad6a-25b928e6fbdd/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Import and export users and customers \u003c 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-92540",
        "datePublished": "2026-09-20T06:00:18.572Z",
        "dateReserved": "2026-09-16T12:58:12.152Z",
        "dateUpdated": "2026-09-20T06:00:18.572Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-92423 (GCVE-0-2026-92423)

    Vulnerability from cvelistv5 – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts
    Summary
    The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/03bd9795-8036-4e… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Meow Gallery Affected: 0 , < 5.5.5 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Meow Gallery",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "5.5.5",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Kaan \u00d6zbek"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user\u0027s own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users\u0027 draft and private posts."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-200 Information Exposure",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:18.400Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/03bd9795-8036-4ec9-ab11-8dc2059d4245/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Meow Gallery \u003c 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-92423",
        "datePublished": "2026-09-20T06:00:18.400Z",
        "dateReserved": "2026-09-16T09:59:30.597Z",
        "dateUpdated": "2026-09-20T06:00:18.400Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-92422 (GCVE-0-2026-92422)

    Vulnerability from cvelistv5 – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Meow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route
    Summary
    The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/17a94434-3ccc-42… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Meow Gallery Affected: 0 , < 5.5.5 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Meow Gallery",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "5.5.5",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "JunHee CHO"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-345 Insufficient Verification of Data Authenticity",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:18.231Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/17a94434-3ccc-4282-99f5-d18043673669/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Meow Gallery \u003c 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-92422",
        "datePublished": "2026-09-20T06:00:18.231Z",
        "dateReserved": "2026-09-16T09:59:23.399Z",
        "dateUpdated": "2026-09-20T06:00:18.231Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-92410 (GCVE-0-2026-92410)

    Vulnerability from cvelistv5 – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF
    Summary
    The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/4c217ac6-e191-4b… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Sign-up Sheets Affected: 0 , < 2.4.0 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Sign-up Sheets",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "2.4.0",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "JunHee CHO"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:18.055Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/4c217ac6-e191-4be9-becc-47cacf2b4e25/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Sign-up Sheets \u003c 2.4.0 - Arbitrary Sign-up Deletion via CSRF",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-92410",
        "datePublished": "2026-09-20T06:00:18.055Z",
        "dateReserved": "2026-09-16T09:05:32.493Z",
        "dateUpdated": "2026-09-20T06:00:18.055Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-87840 (GCVE-0-2026-87840)

    Vulnerability from cvelistv5 – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering
    Summary
    The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/7a81fd1d-9df5-45… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Tripzzy Affected: 1.3.4 , < 1.5.1 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Tripzzy",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "1.5.1",
                  "status": "affected",
                  "version": "1.3.4",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Pablo Gonz\u00e1lez P\u00e9rez"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Francisco Jos\u00e9 Ram\u00edrez Vicente and I\u00f1igo S\u00e1nchez Enciso"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Tripzzy  WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy  WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-284 Improper Access Control",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:17.845Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/7a81fd1d-9df5-4521-9a32-31fc9fe77960/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Tripzzy \u003c 1.5.1 - Unauthenticated Booking Data Tampering",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-87840",
        "datePublished": "2026-09-20T06:00:17.845Z",
        "dateReserved": "2026-09-09T11:22:38.094Z",
        "dateUpdated": "2026-09-20T06:00:17.845Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-87839 (GCVE-0-2026-87839)

    Vulnerability from cvelistv5 – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion
    Summary
    The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/e5145602-cb5e-4e… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Tripzzy Affected: 1.1.8 , < 1.5.1 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Tripzzy",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "1.5.1",
                  "status": "affected",
                  "version": "1.1.8",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Pablo Gonz\u00e1lez P\u00e9rez"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Francisco Jos\u00e9 Ram\u00edrez Vicente and I\u00f1igo S\u00e1nchez Enciso"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Tripzzy  WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-284 Improper Access Control",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:17.654Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/e5145602-cb5e-4ef9-a51b-8f161200d014/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Tripzzy \u003c 1.5.1 - Unauthenticated Arbitrary Comment Deletion",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-87839",
        "datePublished": "2026-09-20T06:00:17.654Z",
        "dateReserved": "2026-09-09T11:22:36.182Z",
        "dateUpdated": "2026-09-20T06:00:17.654Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-87068 (GCVE-0-2026-87068)

    Vulnerability from cvelistv5 – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import
    Summary
    The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/cc38d82b-a766-4d… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Forminator Forms Affected: 1.57.0 , < 1.57.2.1 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Forminator Forms",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "1.57.2.1",
                  "status": "affected",
                  "version": "1.57.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Karthik Ramakrishnan"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Forminator Forms  WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-269 Improper Privilege Management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:17.478Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/cc38d82b-a766-4da0-bf81-d9ba8fa9e51e/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Forminator Forms \u003c 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-87068",
        "datePublished": "2026-09-20T06:00:17.478Z",
        "dateReserved": "2026-09-08T19:02:31.821Z",
        "dateUpdated": "2026-09-20T06:00:17.478Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-87067 (GCVE-0-2026-87067)

    Vulnerability from cvelistv5 – Published: 2026-09-20 06:00 – Updated: 2026-09-20 06:00
    VLAI
    Title
    Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection
    Summary
    The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.
    Severity
    No CVSS data available.
    References
    URL Tags
    https://wpscan.com/vulnerability/9f5da02e-55af-46… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Forminator Forms Affected: 1.57.0.7 , < 1.57.2.1 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Forminator Forms",
              "vendor": "Unknown",
              "versions": [
                {
                  "lessThan": "1.57.2.1",
                  "status": "affected",
                  "version": "1.57.0.7",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Karthik Ramakrishnan"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "WPScan"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Forminator Forms  WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms  WordPress plugin before 1.57.2.1\u0027s own settings, so the issue is reachable well below administrator on sites that use that feature."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-20T06:00:17.300Z",
            "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            "shortName": "WPScan"
          },
          "references": [
            {
              "tags": [
                "exploit",
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://wpscan.com/vulnerability/9f5da02e-55af-463f-8b1a-9fe792d589c4/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Forminator Forms \u003c 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection",
          "x_generator": {
            "engine": "WPScan CVE Generator"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "assignerShortName": "WPScan",
        "cveId": "CVE-2026-87067",
        "datePublished": "2026-09-20T06:00:17.300Z",
        "dateReserved": "2026-09-08T19:01:39.377Z",
        "dateUpdated": "2026-09-20T06:00:17.300Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }