WordPress ElementsKit Elementor Addons plugin < 3.10.01 - Subsite Administrator+ PHP Code Injection vulnerability

Subsite Administrator+ PHP Code Injection vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ElementsKit Elementor addons Lite versions 3.10.01...

CVE-2026-16623 Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...

CVE-2026-17605

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload in the isAllowedExtension process. An attacker can achieve arbitrary code execution by uploading a specially crafted file with a multi-segment filename containing a blocked extension as a non-terminal segment, whic...

CVE-2026-13392

The ElementsKit Elementor Addons WordPress plugin versions before 3.10.01 is vulnerable to PHP code injection. The plugin fails to prevent custom-widget definitions saved by administrative users from being written verbatim into generated PHP files. Because the plugin subsequently executes these f...

CVE-2026-13392 ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently...

CVE-2026-16610 Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key

The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...

Joomla! Extension 'iCagenda' 3.2.1 < 3.9.15 / 4.x < 4.0.8 Arbitrary Files Upload

The version of the iCagenda extension for the Joomla! application running on the remote host is 3.2.1 prior to 3.9.15 or 4.x prior to 4.0.8. It is, therefore, affected by an arbitrary files upload vulnerability in the file attachment feature, ultimately resulting in PHP code upload and execution...

CVE-2026-45293

WordPress Coding Standards is a set of PHPCodeSniffer rules sniffs that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff active in the WordPress and WordPress-Extra rulesets reconstructed the $ver argument passed to functions such as...

Resources Downloaded over Insecure Protocol

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol through the configuration API. An attacker can execute arbitrary PHP code by uploading a malicious ZIP file ...

CVE-2026-60026

Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user core.create/core.edit could inject PHP tags in element content, that got...

CVE-2026-35048

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the addslashes protection is bypassed because it checks for getmagicquotesgpc, a function removed i...

PT-2026-60434

The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on the execTemplate function. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on...

CVE-2026-46640

CVE-2026-46640 — Twig (PHP template engine) : The issue affects Twig 3.15.0 through 3.26.0 where _self.() and import-alias dynamic attribute syntax can concatenate attacker-controlled strings into a MacroReferenceExpression name, bypassing identifier validation and causing raw PHP to be emitted a...

CVE-2026-46640 Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

Twig is a template language for PHP. From 3.15.0 until 3.26.0, self. and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and...

CVE-2026-46633 Twig: PHP code injection via `{% use %}` template name

Twig is a template language for PHP. Prior to 3.26.0, Compiler::string does not escape single quotes when a template name from a % use % tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the...

CVE-2026-15338

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the gettypetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute...

CVE-2026-15338 LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the gettypetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute...

CVE-2026-15338

CVE-2026-15338 concerns the LA-Studio Element Kit for Elementor plugin for WordPress. Affected: all versions up to 1.6.1. Issue: Local File Inclusion via the get_type_template function in the progress_type widget setting. Exploitation requires authenticated access at contributor level or higher, ...

CVE-2026-9726 Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce Basket allows Object Injection. This issue affects Drupal AlternativeCommerce Basket versions: from 0.0.0 to 2.1.17...