Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "TikTok",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.4.2",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "RIA Labs"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site\u0027s own credentials. It matches that code loosely, so URLs that merely resemble the expected one trigger it too, and the callback runs on every request to the site rather than only on the administrator\u0027s sign-in."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:18.907Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e74a467a-9eb1-4da3-933a-879c9c026f4f/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-92965",
    "datePublished": "2026-09-20T06:00:18.907Z",
    "dateReserved": "2026-09-17T13:04:15.928Z",
    "dateUpdated": "2026-09-20T06:00:18.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Import and export users and customers",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.5.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "BINESH MADHARAPU"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:18.739Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/b31fb9ee-9f65-43d0-88fa-da99513f8a3b/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Import and export users and customers \u003c 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-92541",
    "datePublished": "2026-09-20T06:00:18.739Z",
    "dateReserved": "2026-09-16T12:58:16.942Z",
    "dateUpdated": "2026-09-20T06:00:18.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Import and export users and customers",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.5.2",
              "status": "affected",
              "version": "2.4.16",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "yzx001"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:18.572Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/3a112d4b-9824-4128-ad6a-25b928e6fbdd/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Import and export users and customers \u003c 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-92540",
    "datePublished": "2026-09-20T06:00:18.572Z",
    "dateReserved": "2026-09-16T12:58:12.152Z",
    "dateUpdated": "2026-09-20T06:00:18.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Meow Gallery",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "5.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kaan \u00d6zbek"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user\u0027s own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users\u0027 draft and private posts."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:18.400Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/03bd9795-8036-4ec9-ab11-8dc2059d4245/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Meow Gallery \u003c 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-92423",
    "datePublished": "2026-09-20T06:00:18.400Z",
    "dateReserved": "2026-09-16T09:59:30.597Z",
    "dateUpdated": "2026-09-20T06:00:18.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Meow Gallery",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "5.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "JunHee CHO"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-345 Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:18.231Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/17a94434-3ccc-4282-99f5-d18043673669/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Meow Gallery \u003c 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-92422",
    "datePublished": "2026-09-20T06:00:18.231Z",
    "dateReserved": "2026-09-16T09:59:23.399Z",
    "dateUpdated": "2026-09-20T06:00:18.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Sign-up Sheets",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "JunHee CHO"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:18.055Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/4c217ac6-e191-4be9-becc-47cacf2b4e25/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Sign-up Sheets \u003c 2.4.0 - Arbitrary Sign-up Deletion via CSRF",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-92410",
    "datePublished": "2026-09-20T06:00:18.055Z",
    "dateReserved": "2026-09-16T09:05:32.493Z",
    "dateUpdated": "2026-09-20T06:00:18.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Tripzzy",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.5.1",
              "status": "affected",
              "version": "1.3.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pablo Gonz\u00e1lez P\u00e9rez"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Francisco Jos\u00e9 Ram\u00edrez Vicente and I\u00f1igo S\u00e1nchez Enciso"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Tripzzy  WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy  WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:17.845Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/7a81fd1d-9df5-4521-9a32-31fc9fe77960/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Tripzzy \u003c 1.5.1 - Unauthenticated Booking Data Tampering",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-87840",
    "datePublished": "2026-09-20T06:00:17.845Z",
    "dateReserved": "2026-09-09T11:22:38.094Z",
    "dateUpdated": "2026-09-20T06:00:17.845Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Tripzzy",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.5.1",
              "status": "affected",
              "version": "1.1.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pablo Gonz\u00e1lez P\u00e9rez"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Francisco Jos\u00e9 Ram\u00edrez Vicente and I\u00f1igo S\u00e1nchez Enciso"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Tripzzy  WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:17.654Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e5145602-cb5e-4ef9-a51b-8f161200d014/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Tripzzy \u003c 1.5.1 - Unauthenticated Arbitrary Comment Deletion",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-87839",
    "datePublished": "2026-09-20T06:00:17.654Z",
    "dateReserved": "2026-09-09T11:22:36.182Z",
    "dateUpdated": "2026-09-20T06:00:17.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Forminator Forms",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.57.2.1",
              "status": "affected",
              "version": "1.57.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Karthik Ramakrishnan"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Forminator Forms  WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:17.478Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/cc38d82b-a766-4da0-bf81-d9ba8fa9e51e/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Forminator Forms \u003c 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-87068",
    "datePublished": "2026-09-20T06:00:17.478Z",
    "dateReserved": "2026-09-08T19:02:31.821Z",
    "dateUpdated": "2026-09-20T06:00:17.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Forminator Forms",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.57.2.1",
              "status": "affected",
              "version": "1.57.0.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Karthik Ramakrishnan"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Forminator Forms  WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms  WordPress plugin before 1.57.2.1\u0027s own settings, so the issue is reachable well below administrator on sites that use that feature."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:17.300Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/9f5da02e-55af-463f-8b1a-9fe792d589c4/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Forminator Forms \u003c 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-87067",
    "datePublished": "2026-09-20T06:00:17.300Z",
    "dateReserved": "2026-09-08T19:01:39.377Z",
    "dateUpdated": "2026-09-20T06:00:17.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unlimited Elements For Elementor",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.0.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Herman"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:16.869Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/459a7479-ebd8-4e46-a709-cb86d0386f9b/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unlimited Elements For Elementor \u003c 2.0.20 - Subscriber+ PHP Object Injection",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-85017",
    "datePublished": "2026-09-20T06:00:16.869Z",
    "dateReserved": "2026-09-02T19:18:51.316Z",
    "dateUpdated": "2026-09-20T06:00:16.869Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kirki",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.3.1",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mohammed Abd Alrahman"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Kirki  WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site\u0027s own origin and runs in the session of anyone who opens it."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:16.686Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/02ed6d31-84f3-4723-8b49-ddb00c7db7d3/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-84223",
    "datePublished": "2026-09-20T06:00:16.686Z",
    "dateReserved": "2026-09-01T11:50:32.830Z",
    "dateUpdated": "2026-09-20T06:00:16.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAML Single Sign On",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "6.0.0",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Karthik Ramakrishnan"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The SAML Single Sign On  WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site\u0027s identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:16.509Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/4ae66b2c-a0de-405f-baca-127302257540/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "SAML Single Sign On \u003c 6.0.0 - Unauthenticated Privilege Escalation via Account Matching",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-82842",
    "datePublished": "2026-09-20T06:00:16.509Z",
    "dateReserved": "2026-08-31T08:27:11.846Z",
    "dateUpdated": "2026-09-20T06:00:16.509Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Photo Gallery, Sliders, Proofing and Themes",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Erwan LR (WPScan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Photo Gallery, Sliders, Proofing and   WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:16.342Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/bede7803-8ffd-4e17-852e-bce634466fcb/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "NextGEN Gallery \u003c 4.5.0 - Authenticated Plugin Image Settings Update",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-81654",
    "datePublished": "2026-09-20T06:00:16.342Z",
    "dateReserved": "2026-08-27T09:27:38.744Z",
    "dateUpdated": "2026-09-20T06:00:16.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Photo Gallery, Sliders, Proofing and Themes",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Erwan LR (WPScan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Photo Gallery, Sliders, Proofing and   WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:16.158Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/0bceb61b-6986-4669-896c-4279ecef0603/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "NextGEN Gallery \u003c 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-81653",
    "datePublished": "2026-09-20T06:00:16.158Z",
    "dateReserved": "2026-08-27T09:27:36.944Z",
    "dateUpdated": "2026-09-20T06:00:16.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Photo Gallery, Sliders, Proofing and Themes",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "affected",
              "version": "3.59.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Meher Sudhakar Abbireddi"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Photo Gallery, Sliders, Proofing and   WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image\u0027s stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and   WordPress plugin before 4.5.0\u0027s own capability-gated read path reserves to administrators."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:15.977Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/58759289-adca-47d5-8c15-c073c9f14c31/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "NextGEN Gallery \u003c 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-81652",
    "datePublished": "2026-09-20T06:00:15.977Z",
    "dateReserved": "2026-08-27T09:27:34.936Z",
    "dateUpdated": "2026-09-20T06:00:15.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Photo Gallery, Sliders, Proofing and Themes",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Murad Akhmedov"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Photo Gallery, Sliders, Proofing and   WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path, and including galleries belonging to other users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:15.803Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/69ccebff-414d-49bb-b914-cae87ab27f4f/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "NextGEN Gallery \u003c 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-81651",
    "datePublished": "2026-09-20T06:00:15.803Z",
    "dateReserved": "2026-08-27T09:27:32.697Z",
    "dateUpdated": "2026-09-20T06:00:15.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Photo Gallery, Sliders, Proofing and Themes",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alihan \u015eahin"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Photo Gallery, Sliders, Proofing and   WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that execute them, run arbitrary code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:15.631Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/7c1443ae-14b4-43ca-bb1a-b6a3f9b27c57/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "NextGEN Gallery \u003c 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-81650",
    "datePublished": "2026-09-20T06:00:15.631Z",
    "dateReserved": "2026-08-27T09:27:24.690Z",
    "dateUpdated": "2026-09-20T06:00:15.631Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Import and export users and customers",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.4.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Binesh Madharapu"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:15.453Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/f57577b2-3031-433a-a3e1-758d12b244d1/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Import and export users and customers \u003c 2.4.5 - Admin+ SSRF via bp_avatar",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16542",
    "datePublished": "2026-09-20T06:00:15.453Z",
    "dateReserved": "2026-07-22T09:43:42.454Z",
    "dateUpdated": "2026-09-20T06:00:15.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Master Slider",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThanOrEqual": "3.11.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "WEI HSIANG WANG"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Master Slider  WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed.\n\nNo fixed version is available. Until one ships, restrict the Contributor role to trusted users, or deactivate the Master Slider  WordPress plugin through 3.11.2. Site owners who need to keep it active can block the ms_slider shortcode for roles below Editor, for example with a shortcode-restriction Master Slider  WordPress plugin through 3.11.2, which prevents the attack without removing the Master Slider  WordPress plugin through 3.11.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:15.268Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/06a5409c-3070-417f-98cb-0ca8ddbfe14c/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Master Slider \u003c= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-14844",
    "datePublished": "2026-09-20T06:00:15.268Z",
    "dateReserved": "2026-07-06T11:32:52.943Z",
    "dateUpdated": "2026-09-20T06:00:15.268Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "TikTok",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.4.2",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "RIA Labs"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site\u0027s own credentials. It matches that code loosely, so URLs that merely resemble the expected one trigger it too, and the callback runs on every request to the site rather than only on the administrator\u0027s sign-in."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:18.907Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e74a467a-9eb1-4da3-933a-879c9c026f4f/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-92965",
    "datePublished": "2026-09-20T06:00:18.907Z",
    "dateReserved": "2026-09-17T13:04:15.928Z",
    "dateUpdated": "2026-09-20T06:00:18.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Import and export users and customers",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.5.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "BINESH MADHARAPU"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:18.739Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/b31fb9ee-9f65-43d0-88fa-da99513f8a3b/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Import and export users and customers \u003c 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-92541",
    "datePublished": "2026-09-20T06:00:18.739Z",
    "dateReserved": "2026-09-16T12:58:16.942Z",
    "dateUpdated": "2026-09-20T06:00:18.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Import and export users and customers",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.5.2",
              "status": "affected",
              "version": "2.4.16",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "yzx001"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:18.572Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/3a112d4b-9824-4128-ad6a-25b928e6fbdd/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Import and export users and customers \u003c 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-92540",
    "datePublished": "2026-09-20T06:00:18.572Z",
    "dateReserved": "2026-09-16T12:58:12.152Z",
    "dateUpdated": "2026-09-20T06:00:18.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Meow Gallery",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "5.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kaan \u00d6zbek"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user\u0027s own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users\u0027 draft and private posts."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:18.400Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/03bd9795-8036-4ec9-ab11-8dc2059d4245/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Meow Gallery \u003c 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-92423",
    "datePublished": "2026-09-20T06:00:18.400Z",
    "dateReserved": "2026-09-16T09:59:30.597Z",
    "dateUpdated": "2026-09-20T06:00:18.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Meow Gallery",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "5.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "JunHee CHO"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-345 Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T06:00:18.231Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/17a94434-3ccc-4282-99f5-d18043673669/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Meow Gallery \u003c 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-92422",
    "datePublished": "2026-09-20T06:00:18.231Z",
    "dateReserved": "2026-09-16T09:59:23.399Z",
    "dateUpdated": "2026-09-20T06:00:18.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}