CVE-2026-82186 WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...

CVE-2026-82193 WPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path Traversal

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

WordPress WPvivid — Backup, Migration & Staging plugin < 0.9.134 - Admin+ File Write Outside the Backup Directory vulnerability

Admin+ File Write Outside the Backup Directory vulnerability discovered by reconnaissance in WordPress Plugin WPvivid Backup and Migration versions 0.9.134...

CVE-2026-82186

The WPLP Cookie Consent WordPress plugin (specifically versions before 4.4.2 ) is vulnerable to SQL injection due to improper validation of a pagination parameter (the 'offset' parameter) within a SQL query. This flaw allows users with administrator privileges to execute arbitrary SQL commands. S...

CVE-2026-82193

The WPvivid — Backup, Migration & Staging WordPress plugin versions prior to 0.9.134 is vulnerable to a Path Traversal flaw. The application fails to validate user-supplied filenames when constructing a write path, which allows users with administrator privileges to write files of permitted types...

EUVD-2026-70908

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...

CVE-2026-81347 Frontend Admin by DynamiApps < 3.29.13 - Unauthenticated .htaccess and index.php Deletion via Custom Directory Path Traversal

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...

CVE-2026-82186 WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...

CVE-2026-81347

The Frontend Admin by DynamiApps WordPress plugin, versions prior to 3.29.13 , is vulnerable to an unauthenticated directory path traversal. The root cause is a failure to properly validate a user-controllable directory path before deleting files, allowing attackers to delete index.php and .htacc...

WordPress Hummingbird Performance plugin < 3.21.2 - Admin+ Network-Wide RCE vulnerability

Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Hummingbird versions 3.21.2...

CVE-2026-74235: Improper Limitation of a Pathname to a Restricted Directory

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcfhandledownload function accepts parameters prefixed with vdel and appends their values directly to the base configuration directory path without...

PT-2026-91836

Summary @typespec/spector registers a POST /.admin/stop HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to...

CVE-2026-75169

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

CVE-2026-85601: Improper Neutralization of Input During Web Page Generation

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

PT-2026-85501

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

Lutece Core 7.1.7 Remote Code Execution

Lutece Core versions 7.1.7 and below suffer from an authenticated remote code execution vulnerability via XSLT injection. https://packetstorm.news/download/230543...

PT-2026-85421

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

EUVD-2026-71444

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

CVE-2026-78328: Missing Authorization

A missing authorization vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin...

CVE-2026-85603: External Control of File Name or Path

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...