CVE-2026-65572: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...

CVE-2026-66711: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...

CVE-2026-66710: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...

CVE-2026-65509: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in wpDataTables = 7.5.1 versions...

CVE-2026-66703: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in MailOptin = 1.2.78.0 versions...

CVE-2026-65553: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 = 2.1.3 versions...

CVE-2026-65513: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-65573: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Abelle = 1.22 versions...

CVE-2026-3415: Improper Restriction of Recursive Entity References in DTDs

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior...

CVE-2025-13909: Exposure of Sensitive Information to an Unauthorized Actor

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...

CVE-2026-67871: Buffer Copy without Checking Size of Input

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, addressspacebs.c, sopcnodemgthelperinternal.c, and toolkittestserver...

CVE-2026-3418: Unrestricted Upload of File with Dangerous Type

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

CVE-2026-19127: Insufficient Verification of Data Authenticity

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal LTD redemption codes, an unauthenticated attacker...

CVE-2026-66709: Improper Control of Generation of Code

Shop manager Remote Code Execution RCE in CTX Feed = 6.6.42 versions...

CVE-2026-66695: Path Traversal: '.../...//'

Unauthenticated Path Traversal in W3 Total Cache = 2.10.2 versions...

CVE-2026-66440: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WPIDE – File Manager & Code Editor = 3.5.7 versions...

CVE-2026-28111: Incorrect Privilege Assignment

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

CVE-2026-61963: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...

CVE-2026-65560: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

CVE-2026-28169: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier = 2.52.0 versions...