CVE-2026-73366

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73366

The WordPress Easy Google Maps plugin (≤1.13.0) has an unauthenticated PHP Object Injection vulnerability, exploitable remotely without credentials, scoring CVSS 9.8 (Critical). No in-the-wild exploitation or patch details are provided in the documents.

PT-2026-77102

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73367: Inclusion of Functionality from Untrusted Control Sphere

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

PT-2026-77103

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

CVE-2026-73366: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability

Remote File Inclusion vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Google Maps versions 1.14.2...

WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Google Maps versions = 1.13.0...

CVE-2026-72603

An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file witho...

CVE-2026-72603 wg-easy wg-easy - OS Command Injection

An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file witho...

CVE-2026-72603 wg-easy wg-easy - OS Command Injection

An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file witho...

CVE-2026-72603 wg-easy wg-easy - OS Command Injection

An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file witho...

CVE-2026-72603

CVE-2026-72603 affects wg-easy 15.3.0. An OS command injection exists when newline-delimited WireGuard PostUp directives are injected into the client name field, which is written to the WireGuard configuration without neutralizing newlines. This allows an attacker with the clients.create permissi...

EUVD-2026-56042

An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file witho...

CVE-2026-72603

An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file witho...

CVE-2026-72603: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file witho...

PT-2026-70147

Name of the Vulnerable Software and Affected Versions wg-easy version 15.3.0 Description An OS command injection issue exists where users with the clients.create permission can execute arbitrary commands as root. This occurs because the client name field is written to the WireGuard configuration...

CVE-2026-18988

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordionheaderrenderer function, which emits the...

CVE-2026-18988 Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordionheaderrenderer function, which emits the...

CVE-2026-18988

The CVE-2026-18988 entry concerns the Easy Accordion plugin for WordPress, affected in versions up to and including 3.1.8. The underlying issue is insufficient input sanitization and output escaping in accordion_header_renderer(), which emits attacker-supplied tag names using esc_attr() in an HTM...