tag
Cwe-269
Critical
Simple User Registration WordPress Plugin — Unauthenticated Privilege Escalation (CVE-2025-4334)
CVE-2025-4334·
"Simple User Registration" WordPress plugin (registration/form-builder plugin, wpr_submit_form AJAX action)
unpatched
Critical
Real Spaces WordPress Theme Unauthenticated Privilege Escalation via `imic_agent_register` (CVE-2025-6758)
CVE-2025-6758·
Real Spaces - Properties Directory Theme for WordPress (imic_agent_register AJAX handler)
unpatched
Critical
Opal Estate Pro WordPress Plugin Unauthenticated Administrator Registration (CVE-2025-6934)
CVE-2025-6934·
Opal Estate Pro (WordPress real-estate plugin)
unpatched
Critical
Fox LMS `createOrder` Unauthenticated Privilege Escalation to Administrator (CVE-2025-14156)
CVE-2025-14156·
Fox LMS (WordPress LMS plugin)
unpatched
Critical
WordPress "Import and Export Users and Customers" Plugin Privilege Escalation (CVE-2026-3629)
CVE-2026-3629·
Import and Export Users and Customers (WordPress plugin)
unpatched
Critical
User Registration & Membership Unauthenticated Admin Privilege Escalation (CVE-2026-1492)
CVE-2026-1492·
User Registration & Membership WordPress plugin (Custom Registration Form Builder, Login Form, User Profile, Content Restriction & Membership)
unpatched
High
Masteriyo LMS Authenticated Privilege Escalation to Administrator (CVE-2026-4484)
CVE-2026-4484·
Masteriyo LMS plugin for WordPress
unpatched
High
LatePoint Calendar Booking Plugin Agent-to-Administrator Privilege Escalation — CVE-2026-6741
CVE-2026-6741·
LatePoint – Calendar Booking Plugin for Appointments and Events (WordPress plugin, slug latepoint)
patched
High
Easy Elements for Elementor Unauthenticated Privilege Escalation via `custom_meta` Overwrite (CVE-2026-9018)
CVE-2026-9018·
Easy Elements for Elementor – Addons & Website Templates (easy-elements WordPress plugin)
patched
High
Azuriom CMS Broken Access Control — Account Takeover via AzLink Server Token — CVE-2026-54415
CVE-2026-54415·
Azuriom CMS
patched