CVE-2026-56066: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images = 3.11.4 versions...

CVE-2026-56063: Missing Authorization

Unauthenticated Broken Access Control in MailChimp Block = 1.1.15 versions...

CVE-2026-56059: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Travel Booking = 2.2.5 versions...

CVE-2026-56057: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Uncanny Automator Pro = 7.3.0.6 versions...

CVE-2026-56055: Deserialization of Untrusted Data

Subscriber PHP Object Injection in RealHomes = 4.5.3 versions...

CVE-2026-56048: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Payment Gateway Based Fees and Discounts for WooCommerce = 3.0.0 versions...

CVE-2026-56046: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in ListingPro = 2.9.11 versions...

CVE-2026-56045: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Automatic 3.135.1 versions...

CVE-2026-56044: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Blog2Social = 8.9.2 versions...

CVE-2026-56041: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Responsive Lightbox = 2.7.6 versions...

CVE-2026-56039: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Quick Interest Slider = 3.1.6 versions...

CVE-2026-56033: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Dokan Pro = 5.0.4 versions...

CVE-2026-56032: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Buddyboss Platform = 3.0.4 versions...

CVE-2026-56030: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Paytium = 5.0.2 versions...

CVE-2026-56029: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway = 2.7.4 versions...

CVE-2026-56028: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Easy Elements for Elementor – Addons & Website Templates = 1.4.9 versions...

CVE-2026-56031: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Uncanny Automator = 7.3.1.2 versions...

CVE-2026-56027: Unrestricted Upload of File with Dangerous Type

Customer Arbitrary File Upload in Booster for WooCommerce = 8.0.1 versions...

CVE-2026-56026: Server-Side Request Forgery (SSRF)

Subscriber Server Side Request Forgery SSRF in utm.codes = 1.9.0 versions...

CVE-2026-56025: Missing Authorization

Unauthenticated Broken Access Control in Paymob for WooCommerce = 4.1.2 versions...