Ghl Wizard Vulnerabilities

[en] Missing Authorization vulnerability in Niaj Morshed LC Wizard ghl-wizard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LC Wizard: from n/a through <= 2.1.1.

Affected:

up to 2.1.1

Fix:

No patched version reported

Disclosed:

Feb 20, 2026

CVE-2025-68026 on NVD →

The Connector Wizard (formerly LC Wizard) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to update plugin settings.

CVSS:

5.3

Affected:

up to 2.1.1

Fixed in:

2.1.2

Disclosed:

Feb 5, 2026

CVE-2025-68026 on NVD →

The LC Wizard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check in the ghl-wizard/inc/wp_user.php file in versions 1.2.10 to 1.3.0. This makes it possible for unauthenticated attackers to create new user accounts with the administrator role when the PRO functionality is enable...

CVSS:

8.1

Affected:

1.2.10 – 1.3.0

Fixed in:

1.4.0

Disclosed:

Nov 6, 2025

CVE-2025-5483 on NVD →

The LC Wizard plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that w...

CVSS:

6.4

Affected:

up to 1.4.0

Fix:

No patched version reported

Disclosed:

Sep 22, 2025

CVE-2025-58237 on NVD →

Affected:

up to 1.4.0

Fix:

No patched version reported

CVE-2025-58237 on NVD →