CVE-2026-12720 Kirki < 6.0.13 - Unauthenticated PHP Object Injection

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present ...

EUVD-2026-51431

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present ...

CVE-2026-12720 Kirki < 6.0.13 - Unauthenticated PHP Object Injection

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present ...

CVE-2026-12720

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present ...

CVE-2026-12720

The Kirki WordPress plugin (versions before 6.0.13 ) is vulnerable to PHP Object Injection because it fails to restrict which classes can be instantiated during the deserialization of data that unauthenticated users can store. This vulnerability is triggered when an administrator reviews the stor...

CVE-2026-15209

The JS Help Desk WordPress plugin versions prior to 3.1.5 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to verify if a requesting user owns the ticket being loaded. Consequently, a low-privileged authenticated user can provide a different user's ticket ID...

CVE-2026-14929

The JS Help Desk WordPress plugin, in versions prior to 3.1.4 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify ownership of a targeted reply before allowing it to be updated. This allows any authenticated user with Subscriber privileges or higher to o...

CVE-2026-14847 Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment...

CVE-2026-14843 Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR

The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to...

CVE-2026-14847 Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment...

CVE-2026-14843

The Events Made Easy WordPress plugin versions before 3.1.4 is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to verify if a requester is authorized to modify a targeted record when processing unauthenticated data-change requests. Because the system relies solely on a...

CVE-2026-14847

The Paid Membership Subscriptions WordPress plugin (versions before 3.0.7 ) is vulnerable to a payment data disclosure flaw. The root cause is a failure to perform capability or nonce checks on a specific payment-related AJAX action, leading to an IDOR (Insecure Direct Object Reference) vulnerabi...

SUSE CVE-2025-64431

Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference IDOR attacks through its V2Beta API, allowing authenticated users with specific administrator roles within one organization to access and modify data belongin...

SUSE CVE-2025-64523

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Versions prior to 2.45.1 have an Insecure Direct Object Reference IDOR vulnerability in the FileBrowser application's share deletion functionality. Th...

SUSE CVE-2026-17694

Use after free in DOM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-51361

A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObjectParseObjectAddress to read one byte past the end of the heap-allocated message buffer...

EUVD-2026-51362

A crafted IEC 60870-5-104 I-frame with TypeID 104 CTSNA1 and an inflated object count causes TestCommandgetFromBuffer to read one byte past the end of the heap-allocated message buffer...

CVE-2026-12720: Deserialization of Untrusted Data

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present ...

PT-2026-66688

Name of the Vulnerable Software and Affected Versions Kirki WordPress plugin versions prior to 6.0.13 Description An issue exists where the software fails to restrict which classes can be instantiated during the deserialization of data stored by unauthenticated users. This leads to PHP Object...

PT-2026-66743

Name of the Vulnerable Software and Affected Versions Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions prior to 6.2.9 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers...