All packages
Query Wrangler vulnerabilities
3 known CVE vulnerabilities in Query Wrangler, translated and rated.
- CVE-2026-65491Medium
The Query Wrangler plugin versions 1.5.57 and earlier have a broken access control vulnerability exploitable by a subscriber. A user with subscriber role can gain unauthorized access to functions or data.
- CVE-2026-73992Critical
Subscriber Remote Code Execution (RCE) vulnerability in the Query Wrangler plugin. Affects versions up to 1.5.57.
- CVE-2026-14498High
The Query Wrangler plugin for WordPress up to version 1.5.57 contains a remote code execution vulnerability. Missing capability check and nonce verification in the AJAX handler allow authenticated attackers with Subscriber-level access to execute code on the server.