109911 matches found
CVE-2026-73389 WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...
CVE-2026-73389
CVE-2026-73389 is an unauthenticated PHP Object Injection vulnerability in the Kalles Addons WordPress plugin, affecting versions 1.0.6 and earlier . The flaw allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability, reflected in a CVSS ...
EUVD-2026-62390
Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...
EUVD-2026-62388
Unauthenticated Local File Inclusion in Resido = 1.5 versions...
CVE-2026-73364 WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
CVE-2026-73364
WordPress Flexible Subscriptions plugin (versions ≤ 1.8.1) is vulnerable to PHP Object Injection, allowing unauthenticated remote attackers to execute arbitrary code and achieve full system compromise (CVSS 9.8 Critical). Patchstack reference: https://patchstack.com/database/wordpress/plugin/flex...
EUVD-2026-62384
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
CVE-2026-73364 WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Taylsec in WordPress Plugin FundEngine versions = 1.7.9...
PYSEC-2026-3696 sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
Summary The documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language...
WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ahmed Hassan in WordPress Plugin Forminator versions = 1.57.0...
WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by daroo in WordPress Plugin TaxoPress versions = 3.51.0...
WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Kalles Addons versions = 1.0.6...
WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Van Phuc in WordPress Plugin Flexible Subscriptions versions = 1.8.1...
CVE-2026-18937
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...
CVE-2026-18937 Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...
CVE-2026-18937
The Broken Link Checker WordPress plugin (versions through 2.4.11 ) is vulnerable to unauthenticated Remote Code Execution (RCE) via query variable injection (CWE-94). On sites using plain permalinks , the plugin fails to limit which query variables it accepts from user input, allowing an attacke...
EUVD-2026-62285
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...
CVE-2026-18937 Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...
