109903 matches found
WordPress Ajax Search Lite plugin < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability
Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability discovered by Jakub Herman in WordPress Plugin Ajax Search Lite versions 4.14.5...
WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Flatastic versions = 2.0...
CVE-2026-75963
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...
CVE-2026-13405
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...
CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...
CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...
CVE-2026-13405
The Royal Addons for Elementor WordPress plugin (versions before 1.7.1066 ) is vulnerable to Remote Code Execution (RCE) . The flaw exists because the plugin fails to properly sanitise custom widget markup before writing it to a file that is subsequently executed. This allows authenticated users ...
EUVD-2026-63201
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...
CVE-2026-75963 Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...
CVE-2026-75963
The Events Made Easy WordPress plugin (all versions up to and including 3.2.5 ) is vulnerable to Local File Inclusion via the eme_single_event_page_template function, specifically through the wp_page_template event property. Authenticated attackers with contributor-level access or above can injec...
EUVD-2026-63199
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...
PT-2026-78904
A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...
CVE-2026-66672: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...
CVE-2026-66586: Improper Control of Filename for Include/Require Statement in PHP Program
Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...
CVE-2026-66583: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...
CVE-2026-13405: Improper Control of Generation of Code
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...
PT-2026-78889
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage options capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...
PT-2026-78985
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
PT-2026-78976
Name of the Vulnerable Software and Affected Versions Flatastic versions prior to 2.1 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objects and...