CVE-2025-69115: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme = 1.2.2 versions...

CVE-2025-69111: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...

CVE-2025-69106: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Imba = 1.5.0 versions...

CVE-2025-68524: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Avante 3.0.5 versions...

CVE-2025-60236: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5...

CVE-2026-9690: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Download in WP Media folder Addon = 4.0.1 versions...

CVE-2026-54805: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Falang multilanguage = 1.4.2 versions...

CVE-2026-54811: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP eMember v10.9.4 versions...

CVE-2026-54806: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WP Activity Log = 5.6.3.1 versions...

CVE-2026-54195: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.0.1 versions...

CVE-2026-54194: Deserialization of Untrusted Data

Contributor PHP Object Injection in Fusion Builder = 3.15.4 versions...

CVE-2026-54192: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Popup box = 6.2.9 versions...

CVE-2026-54186: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in JobSearch = 3.2.9 versions...

CVE-2026-54189: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.10 versions...

CVE-2026-54185: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Cornerstone 7.8.8 versions...

CVE-2026-52706: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in JetEngine = 3.8.10 versions...

CVE-2026-52705: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms = 1.4.5 versions...

CVE-2026-52698: Insertion of Sensitive Information Into Sent Data

Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget = 4.2.3 versions...

CVE-2026-49113: Improper Control of Generation of Code

Subscriber Arbitrary Code Execution in Cornerstone 7.8.8 versions...

CVE-2026-49084: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in JetEngine 3.8.9.1 versions...