19791 matches found
WordPress User Frontend plugin < 4.3.10 - Editor+ PHP Object Injection vulnerability
Editor+ PHP Object Injection vulnerability discovered by Hijun Kim in WordPress Plugin WP User Frontend versions 4.3.10...
EUVD-2026-67567
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...
CVE-2026-14558 WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...
CVE-2026-15798 Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-15798
Smart Slider 3 for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'slider' Block Attribute in all versions up to and including 3.5.1.38 , caused by insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inje...
CVE-2026-15798: Improper Neutralization of Input During Web Page Generation
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-14558: Deserialization of Untrusted Data
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...
ImageMagick Integer Overflow DoS
The vulnerability of the console-based graphic editor ImageMagick is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to cause a service failure...
EUVD-2026-67123
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-81817
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-73426
A flaw was found in Trix, a rich text editor. An attacker can exploit a cross-site scripting XSS vulnerability by crafting malicious HTML with a data-trix-serialized-attributes attribute. This attribute can bypass the DOMPurify sanitizer, allowing the execution of arbitrary JavaScript in a user's...
CVE-2026-73427
A flaw was found in Trix, a rich text editor. A remote attacker could exploit this vulnerability by convincing a victim to drag and drop a specially crafted JSON payload into an editor using the Level0InputController. This could bypass sanitization and allow the injection of executable JavaScript...
CVE-2026-81272
Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...
CVE-2026-78274
Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78271
Editor Privilege Escalation in FluentCRM Pro = 3.1.12 versions...
CVE-2026-78275
Editor Arbitrary File Deletion in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78276
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-81272
CVE-2026-81272 affects the WordPress FluentPlayer Pro plugin in versions 1.3.2 and below , where an Editor-level Broken Access Control flaw allows a user with the Editor role to perform actions they should not be permitted to. The CVSS 3.1 score is 4.9 (MEDIUM) with the vector AV:N/AC:L/PR:H/UI:N...