Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-23
Zportals - Security Vulnerability (CVE-2026-18365)
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators.
PLUGIN
Zportals
CVE-2026-18365
Risk Score
Threat Entry
Updated 2026-09-23
Zportals - Security Vulnerability (CVE-2026-18364)
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings.
PLUGIN
Zportals
CVE-2026-18364
Risk Score
Threat Entry
Updated 2026-08-26
Zportals - Remote Code Execution (CVE-2026-14553)
The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.
PLUGIN
Zportals
CVE-2026-14553
Risk Score