CVE-2026-16263

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...

CVE-2026-16265 WP Maps < 4.9.7 - Subscriber+ Denial of Service

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...

EUVD-2026-54392

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...

CVE-2026-16265

The WP Maps WordPress plugin (versions

CVE-2026-16258 Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...

CVE-2026-16258

The Ajax Search Lite WordPress plugin (versions before 4.14.5 ) is vulnerable to PHP Object Injection due to the insecure deserialization of untrusted input. This flaw is specifically located in the Search Statistics REST Endpoint . An unauthenticated attacker can exploit this to achieve Remote C...

EUVD-2026-54389

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...

CVE-2026-15361

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...

CVE-2026-15215 Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manage...

CVE-2026-15215 Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manage...

CVE-2026-19196 SourceCodester Photo Share Website ajax.php login sql injection

A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and...

CVE-2026-15215: Improper Privilege Management

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manage...

CVE-2026-15361: Improper Neutralization of Special Elements used in an SQL Command

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...

CVE-2026-16258: Deserialization of Untrusted Data

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...

CVE-2026-16265: Uncontrolled Resource Consumption

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service...

CVE-2026-66439

Unauthenticated Cross Site Scripting XSS in Advanced AJAX Product Filters = 3.2.0.3 versions...

CVE-2026-28139

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

CVE-2026-66439 WordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Advanced AJAX Product Filters = 3.2.0.3 versions...

CVE-2026-66439

Unauthenticated Cross Site Scripting XSS in Advanced AJAX Product Filters = 3.2.0.3 versions...

CVE-2026-28139

CVE-2026-28139 concerns the WordPress plugin Ajax Search Lite (vulnerable: ≤ 4.14.4). The issue is an unauthenticated PHP Object Injection in the plugin’s handling of objects, as described in CVE details and corroborated by multiple feeds. Affected component: the Ajax Search Lite plugin; root cau...