Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-26
ProSolution WP Client - Cross-Site Scripting (XSS) (CVE-2026-19056)
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.
PLUGIN
ProSolution WP Client
CVE-2026-19056
Risk Score
Threat Entry
Updated 2026-08-26
ProSolution WP Client - Cross-Site Scripting (XSS) (CVE-2026-19055)
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.
PLUGIN
ProSolution WP Client
CVE-2026-19055
Risk Score
Threat Entry
Updated 2026-08-20
Prosolution Wp Client - Remote Code Execution (CVE-2026-16098)
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the allow-listed multipart filename before the file is saved, and a post-save extension check that fails to delete the already-written file. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce required to reach the upload handler is publicly…
PLUGIN
Prosolution Wp Client
CVE-2026-16098
Risk Score
Threat Entry
Updated 2026-08-20
Prosolution Wp Client - Remote Code Execution (CVE-2026-14524)
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol_fileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker must first call the proSol_fileUploadModalProcess handler to poison their own session with a path-traversal key, then call proSol_fileDeleteProcess with that key as the filename parameter; both…
PLUGIN
Prosolution Wp Client
CVE-2026-14524
Risk Score
Threat Entry
Updated 2026-08-26
ProSolution WP Client - Broken Access Control (CVE-2026-19052)
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the ProSolution WP Client WordPress plugin before 2.0.9's activity records.
PLUGIN
ProSolution WP Client
CVE-2026-19052
Risk Score
Threat Entry
Updated 2026-08-26
ProSolution WP Client - Cross-Site Request Forgery (CSRF) (CVE-2026-19050)
The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary requests to internal hosts and services, including requests with an attacker-chosen method, headers and body.
PLUGIN
ProSolution WP Client
CVE-2026-19050
Risk Score
Threat Entry
Updated 2026-08-26
ProSolution WP Client - SQL Injection (CVE-2026-19053)
The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.
PLUGIN
ProSolution WP Client
CVE-2026-19053
Risk Score
Threat Entry
Updated 2026-08-26
ProSolution WP Client - Cross-Site Scripting (XSS) (CVE-2026-19049)
The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores.
PLUGIN
ProSolution WP Client
CVE-2026-19049
Risk Score
Threat Entry
Updated 2026-07-24
Prosolution Wp Client - Remote Code Execution (CVE-2026-6555)
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory. This makes it possible for unauthenticated attackers to upload malicious PHP files and achieve remote code execution by sending a valid first file followed by a malicious file.
PLUGIN
Prosolution Wp Client
CVE-2026-6555
Risk Score
Threat Entry
Updated 2026-07-25
Prosolution Wp Client - Remote Code Execution (CVE-2026-2942)
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'proSol_fileUploadProcess' function in all versions up to, and including, 1.9.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Prosolution Wp Client
CVE-2026-2942
Risk Score