Advisories · Technology

solacewp Solace Extra.

Every CVE that names solacewp Solace Extra among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-18316 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action
- solacewp Solace Extra
- Broken access control
Not analysed yet 16 Aug 2026
CVE-2026-27535 CVE record

CVSS 7.1 High

WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability
- solacewp Solace Extra
- Broken access control
Not analysed yet 13 Aug 2026
CVE-2026-13250 CVE record

CVSS 5.3 Medium

Solace Extra <= 1.5.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJAX Action
- solacewp Solace Extra
- Broken access control
Not analysed yet 11 Jul 2026
CVE-2025-58203 CVE record

CVSS 4.4 Medium

WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability
- solacewp Solace Extra
- Server-side request forgery (SSRF)
Not analysed yet 27 Aug 2025
CVE-2025-47464 CVE record

CVSS 4.9 Medium

WordPress Solace Extra plugin <= 1.3.1 - Server Side Request Forgery (SSRF) Vulnerability
- solacewp Solace Extra
- Server-side request forgery (SSRF)
Not analysed yet 7 May 2025
CVE-2025-32652 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

WordPress Solace Extra plugin <= 1.3.1 - Arbitrary File Upload vulnerability
- solacewp Solace Extra
- Unrestricted file upload
Not analysed yet 17 Apr 2025