EUVD-2026-52281

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure...

CVE-2026-78274

Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78276

Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...

EUVD-2026-66939

Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78276 WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability

Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...

EUVD-2026-66937

Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...

EUVD-2026-66936

Subscriber Cross Site Scripting XSS in Fluent Boards Pro = 2.0.11 versions...

PT-2026-82457

Name of the Vulnerable Software and Affected Versions Fluent Boards Pro versions prior to 2.0.12 Description An issue allows an editor to perform arbitrary file deletion within the application. Recommendations Update to version 2.0.12 or later...

PT-2026-82455

Name of the Vulnerable Software and Affected Versions Fluent Boards Pro versions prior to 2.0.12 Description Cross Site Scripting XSS exists in the software, allowing users with Subscriber privileges to execute malicious scripts in the browser of other users. Recommendations Update to version...

CVE-2026-81277: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...

WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability

SQL Injection vulnerability discovered by JunHee CHO in WordPress Plugin Suggestion Engine for WooCommerce versions = 2.0.11...

CVE-2026-78278

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...

CVE-2026-72831 Grav through 2.0.11 Authentication Bypass via Flex Objects

The Flex Objects plugin through 1.4.6, tested with Grav 2.0.11 contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the...

CVE-2026-16618

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

CVE-2026-16618 ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

CVE-2026-69088

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

CVE-2026-10081 Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Goog...

PYSEC-2026-805 Terms and Conditions Module vulnerable to Open Redirect

A vulnerability has been found in cyface Terms and Conditions Module up to 2.0.10 and classified as problematic. Affected by this vulnerability is the function returnTo of the file termsandconditions/views.py. The manipulation leads to open redirect. The attack can be launched remotely. Upgrading...

PT-2026-53055

Name of the Vulnerable Software and Affected Versions Spexo theme for WordPress versions prior to 2.0.12 Description Unauthorized access is possible due to a missing capability check in the activate plugin function. This allows authenticated users with Subscriber-level permissions or higher to...