Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-48197

WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Publishpress Wordpress-extensions
Products
Capabilities Publishpress Capabilities
CVE-2026-94487

WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Publishpress Wordpress
Products
Capabilities Wordpress
CVE-2026-28183

WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Publishpress Wordpress
Products
Capabilities Wordpress
CVE-2022-3366

PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection

The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Publishpress
Products
Capabilities
CVE-2021-25032

PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise

The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.

CVSS 3.1 · 9.8 Critical EPSS 7.1% KEV · Not listed
Vendors
Publishpress
Products
Capabilities