Unknown Solace Extra vulnerabilities

4 CVEs affecting Unknown Solace Extra, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-80333, published 2026-09-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16948, published 2026-08-08. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged…
CVE-2026-80333, published 2026-09-30. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content…
CVE-2026-16966, published 2026-09-02. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of…
CVE-2026-16965, published 2026-08-09. Medium severity, CVSS 4.3. EPSS: 0.1% chance of exploitation in the next 30 days. The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any…