CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66634

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

EUVD-2026-60919

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66620

The WordPress OptionTree plugin (≤ 2.7.3) is vulnerable to PHP Object Injection via its Editor component. CVSS 7.2 (HIGH) reflects network attack vector, low complexity, and high impact across confidentiality, integrity, and availability, requiring attacker privileges. Exploitation details are no...

EUVD-2026-60913

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-66620 WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-66620 WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-66620

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-32470 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

EUVD-2026-60905

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-32470 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-32470

The WordPress FundEngine plugin (versions ≤ 1.7.9) is vulnerable to unauthenticated PHP Object Injection, discovered by researcher daroo. CVSS 3.1 scores this critical (9.8) with network attack vector, no privileges or user interaction required, impacting confidentiality, integrity, and availabil...

CVE-2026-32470

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-32465 WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

EUVD-2026-60901

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-32465 WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-32465

Essential Real Estate is a WordPress plugin affected by a PHP Object Injection vulnerability in versions 5.3.3 and below . The flaw is located in the plugin's customer-facing functionality, allowing an authenticated low-privilege user to inject a malicious PHP object over the network without user...

CVE-2026-32465

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

UBUNTU-CVE-2026-23929

Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Jakub Herman in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...