CVE-2026-110514

MediumCVSS 4.9/10Last modified Oct 21, 2026

Description

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their original listings and URLs.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Unknown	WPZOOM Portfolio Lite	< 1.4.34

References

https://wpscan.com/vulnerability/a6d3be6f-2203-4bc3-9f65-4eba2e9d2bc4/

Timeline

Published: Oct 21, 2026
Last modified: Oct 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1105165.5The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attri CVE-2026-110529.6Type Confusion in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process CVE-2026-1105238.1The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment ga CVE-2026-1105246.8The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storin CVE-2026-1105258.8The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in th CVE-2026-1105275.3The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration wh CVE-2026-1105307.2The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicat CVE-2026-1105328.6The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement CVE-2026-1105336.4The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_v CVE-2026-1105346.4The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and CVE-2026-1105358.8Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation CVE-2026-11053610.0A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP