OpenCATS - Command Injection

OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard. id: CVE-2026-277...

Ads Pro Plugin <= 4.89 - Local File Inclusion

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsatemplate' parameter of the bsapreviewcallback function. This makes it possible for unauthenticated attackers to includ...

Invision Community <=5.0.6 Unauthenticated RCE via Template Injection

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller /applications/core/modules/front/system/themeeditor.php, where a protected method named customCss can be invoked by unauthenticated...

CVE-2026-75963

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-13405

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

EUVD-2026-63201

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

CVE-2026-13405

Royal Elementor Addons before 1.7.1066 fails to sanitize custom widget markup before writing it to an executed file. An attacker with manage_options capability (or non-super Multisite subsite admin) can inject arbitrary PHP code, achieving remote code execution. CVSS 6.6 MEDIUM. No exploitation o...

PT-2026-78888

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme single event page template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrar...

CVE-2026-17533 All-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...

CVE-2026-73679

ImpressCMS has an authenticated remote code execution vulnerability in the custom tag module. The issue allows authenticated administrators to run arbitrary PHP by storing a payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() and ...

CVE-2026-72819

Grav CMS prior to 2.0.13 is affected by a remote code execution via the Flex Objects plugin settings validation. Authenticated users can upload a ZIP containing PHP code, bypassing name validation with array notation, triggering unZip on a malicious archive and writing PHP files to the web root f...

CVE-2026-15039

The CVE-2026-15039 entry concerns the Gift Cards For WooCommerce Pro plugin for WordPress, affected versions prior to 4.2.10. The root cause is that one upload path does not validate the type of uploaded files, allowing unauthenticated users to upload arbitrary files (including PHP code). This ca...

CVE-2026-69118 Cachet 2.4.1 Authenticated Server-Side Template Injection RCE

Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when...

Imperva Customers Protected Against XSS2Shell (CVE-2026-64638) in WordPress Core

TL;DR: CVE-2026-64638, dubbed XSS2Shell, is a high-severity WordPress Core vulnerability that begins as a pre-authentication reflected XSS on the login screen and can be chained to PHP code execution when a logged-in administrator is successfully targeted. WordPress fixed the issue in 7.0.3 and...

EUVD-2026-55214

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

WordPress has fixed a pre-authentication reflected cross-site scripting XSS flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an...

Joomla! Extension 'iCagenda' 3.2.1 < 3.9.15 / 4.x < 4.0.8 Arbitrary Files Upload

The version of the iCagenda extension for the Joomla! application running on the remote host is 3.2.1 prior to 3.9.15 or 4.x prior to 4.0.8. It is, therefore, affected by an arbitrary files upload vulnerability in the file attachment feature, ultimately resulting in PHP code upload and execution...

CVE-2026-60026

Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user core.create/core.edit could inject PHP tags in element content, that got...

CVE-2026-46640 Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

Twig is a template language for PHP. From 3.15.0 until 3.26.0, self. and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and...