CVE-2026-81772

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...

CVE-2026-81283

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-84771

This unauthenticated IDOR vulnerability affects the WordPress PublishPress Permissions plugin in versions 4.8.3 and earlier . Discovered by Brobicho and assigned by Patchstack , it allows a remote attacker with no privileges to access resources they should not, resulting in a low confidentiality ...

CVE-2026-84771 WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...

EUVD-2026-69939

Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...

CVE-2026-84771 WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...

CVE-2026-81772 WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...

CVE-2026-81772

CVE-2026-81772 affects the Ninja Forms – Layout & Styles WordPress plugin in versions ≤ 3.0.31 . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 3.1 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that a remote, unauthenticated attacker requiri...

EUVD-2026-69930

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...

CVE-2026-81772 WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...

CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-81283

WP User Frontend is a WordPress plugin affected by a PHP Object Injection vulnerability in versions 4.3.10 and below . The vulnerability requires low privileges (subscriber-level access), no user interaction, and a low attack complexity, making it accessible to any authenticated subscriber on a s...

EUVD-2026-69922

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin RTMKit versions = 2.1.5...

Malicious Package

Overview bem-page-object is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview array-upsilon-decrypt-container-object is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Brobicho in WordPress Plugin PublishPress Permissions versions = 4.8.3...

CVE-2026-19116

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

EUVD-2026-69851

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...