CVE Database

CVE-2026-54807 Critical · 9.8 CWE-266 Jun 17, 2026

WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.

CVE-2026-54805 High · 8.8 CWE-266 Jun 17, 2026

WordPress Falang multilanguage plugin <= 1.4.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.

CVE-2026-54196 Medium · 6.8 CWE-266 Jun 17, 2026

WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1.

CVE-2026-49058 Critical · 9.8 CWE-266 Jun 17, 2026

WordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.

CVE-2026-39546 High · 7.6 CWE-266 Jun 17, 2026

WordPress MultiLoca plugin <= 4.2.15 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.

CVE-2026-27395 Critical · 9.8 CWE-266 Jun 17, 2026

WordPress Support Board plugin < 3.8.9 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.

CVE-2025-69179 Critical · 9.8 CWE-266 Jun 17, 2026

WordPress Support Ticket Management System plugin <= 1.9 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.

CVE-2025-69138 High · 8.8 CWE-266 Jun 17, 2026

WordPress Genemy theme <= 1.6.6 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Genemy <= 1.6.6 versions.

CVE-2025-59563 High · 8.8 CWE-266 Jun 17, 2026

WordPress Sonaar theme <= 4.27.4 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions.

CVE-2026-53862 Medium · 5.4 CWE-266 Jun 16, 2026

OpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening

OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing authority beyond intended scope limits.

CVE-2026-53847 Medium · 5.4 CWE-266 Jun 16, 2026

OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope

OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. Attackers with operator.write access can exploit insufficient scope validation to apply unauthorized configuration changes beyond the intended write scope.

CVE-2026-49780 High · 8.8 CWE-266 Jun 15, 2026

WordPress Dokan plugin <= 5.0.2 - Privilege Escalation vulnerability

Customer Privilege Escalation in Dokan <= 5.0.2 versions.

CVE-2026-49083 High · 7.5 CWE-266 Jun 15, 2026

WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

Contributor Privilege Escalation in LatePoint <= 5.5.1 versions.

CVE-2026-49063 High · 7.3 CWE-266 Jun 15, 2026

WordPress Listdom plugin <= 5.5.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions.

CVE-2026-48889 High · 8.8 CWE-266 Jun 15, 2026

WordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Amelia <= 2.3 versions.

CVE-2026-39587 High · 8.1 CWE-266 Jun 15, 2026

WordPress WP BASE Booking plugin <= 5.9.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.

CVE-2026-39583 Critical · 9.8 CWE-266 Jun 15, 2026

WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.

CVE-2026-39579 High · 8.8 CWE-266 Jun 15, 2026

WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability

Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.

CVE-2026-39470 High · 7.2 CWE-266 Jun 15, 2026

WordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerability

Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.

CVE-2026-34901 Critical · 9.8 CWE-266 Jun 15, 2026

WordPress iControlWP plugin <= 5.5.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.

CVE-2026-27407 High · 7.2 CWE-266 Jun 15, 2026

WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability

Editor Privilege Escalation in AI Engine <= 3.4.9 versions.

CVE-2026-49111 High · 8.8 CWE-266 Jun 15, 2026

WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo - LMS: from n/a through 2.2.0.

CVE-2026-12217 High · 7.8 CWE-266 Jun 15, 2026

DVDFab Virtual Drive Signed Kernel Driver dvdfabio.sys privileges management

A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown function in the library dvdfabio.sys of the component Signed Kernel Driver. The manipulation leads to improper privilege management. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-12213 Medium · 4.3 CWE-266 Jun 15, 2026

hcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization

A vulnerability was found in hcengineering Huly Platform up to 0.7.0. Affected by this vulnerability is the function getAccountInfo of the file server/account/src/operations.ts of the component User Information Handler. The manipulation results in improper authorization. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-12212 Medium · 4.3 CWE-266 Jun 15, 2026

hcengineering Huly Platform RPC operations.ts getMailboxSecret access control

A vulnerability has been found in hcengineering Huly Platform up to 0.7.0. Affected is the function getMailboxSecret of the file server/account/src/operations.ts of the component RPC Interface. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.