Unknown Prosolution Wp Client vulnerabilities

6 CVEs affecting Unknown Prosolution Wp Client, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19056, published 2026-08-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-19049, published 2026-08-10. High severity, CVSS 8.6. EPSS: 0.5% chance of exploitation in the next 30 days. The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or…
CVE-2026-19053, published 2026-08-10. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL…
CVE-2026-19052, published 2026-08-12. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing…
CVE-2026-19056, published 2026-08-19. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected…
CVE-2026-19055, published 2026-08-19. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected…
CVE-2026-19050, published 2026-08-12. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP…