CVE-2026-39630

Server-Side Request Forgery SSRF vulnerability in Getty Images Getty Images getty-images allows Server Side Request Forgery.This issue affects Getty Images: from n/a through = 4.1.0...

CVE-2026-24572

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Nelio Software Nelio Content nelio-content allows Blind SQL Injection.This issue affects Nelio Content: from n/a through = 4.2.0...

CVE-2026-24572 WordPress Nelio Content plugin <= 4.2.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Nelio Software Nelio Content nelio-content allows Blind SQL Injection.This issue affects Nelio Content: from n/a through = 4.2.0...

PT-2026-4035

Name of the Vulnerable Software and Affected Versions TangibleWP MyHome Core versions through 4.1.0 Description A flaw exists in TangibleWP MyHome Core that allows for PHP Local File Inclusion due to improper control of filename for include/require statements. This issue is related to a PHP Remot...

WordPress Nelio Content plugin <= 4.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Doan Dinh Van in WordPress Plugin Nelio Content versions = 4.2.0...

CVE-2025-30826

CVE-2025-30826 affects the IP Locator WordPress plugin (IP Locator). The vulnerability is a DOM-based XSS caused by improper input neutralization during web page generation, affecting versions up to 4.1.0 (and from n/a to 4.1.0). The CVSS 3.1 score is 6.5 (Medium) with network access, low attack ...

CVE-2025-26993 WordPress Visual Website Collaboration Atarim plugin <= 4.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Reflected XSS.This issue affects Atarim: from n/a through = 4.1.0...

Input validation

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7getcustomfield and CF7getcurrentuser shortcodes due to missing validation on a user controlled key. This makes it possible for...