CVE-2026-30121: Write-what-where Condition

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability...

CVE-2025-69332: Missing Authorization

Subscriber Broken Access Control in Bookify = 1.1.1 versions...

CVE-2026-40770: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Coupon Affiliates = 7.5.3 versions...

CVE-2026-39471: Deserialization of Untrusted Data

Author PHP Object Injection in ShortPixel Image Optimizer = 6.4.3 versions...

CVE-2026-48965: Insertion of Sensitive Information Into Sent Data

Subscriber Sensitive Data Exposure in XCloner = 4.8.6 versions...

CVE-2026-34901: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in iControlWP = 5.5.3 versions...

CVE-2026-39591: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in WP-BusinessDirectory = 4.0.0 versions...

CVE-2026-49083: Incorrect Privilege Assignment

Contributor Privilege Escalation in LatePoint = 5.5.1 versions...

CVE-2026-48886: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in JS Help Desk = 3.0.9 versions...

CVE-2026-39492: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP Maps = 4.9.1 versions...

CVE-2026-36521: Improper Neutralization of Input During Web Page Generation

PublicCMS V5.202506.d has a Cross Site Scripting XSS vulnerability in the site configuration management module...

CVE-2026-39511: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP Photo Album Plus = 9.1.08.001 versions...

CVE-2026-42384: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments 1.6.11.2 versions...

CVE-2026-34898: Missing Authorization

Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce = 1.5.3 versions...

CVE-2025-68851: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Okay Toolkit = 2.3 versions...

CVE-2026-50877: Improper Limitation of a Pathname to a Restricted Directory

An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying files with names containing traversal characters...

CVE-2026-40771: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Contest Gallery = 28.1.6 versions...

CVE-2026-48835: Missing Authorization

Unauthenticated Broken Access Control in Contact Form by WPForms = 1.10.0.4 versions...

CVE-2026-34900: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.14.2 versions...

CVE-2026-49062: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.Js: from n/a through 1.8.7...