16489 matches found
WordPress User Frontend plugin < 4.3.10 - Editor+ PHP Object Injection vulnerability
Editor+ PHP Object Injection vulnerability discovered by Hijun Kim in WordPress Plugin WP User Frontend versions 4.3.10...
EUVD-2026-67567
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...
CVE-2026-14558 WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...
CVE-2026-15798
Smart Slider 3 for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'slider' Block Attribute in all versions up to and including 3.5.1.38 , caused by insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inje...
The vulnerability of the console-based graphic editor ImageMagick, related to integer overflow, allows a hacker to cause a service failure.
The vulnerability of the console-based graphic editor ImageMagick is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to cause a service failure...
EUVD-2026-67123
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-73426
A flaw was found in Trix, a rich text editor. An attacker can exploit a cross-site scripting XSS vulnerability by crafting malicious HTML with a data-trix-serialized-attributes attribute. This attribute can bypass the DOMPurify sanitizer, allowing the execution of arbitrary JavaScript in a user's...
CVE-2026-73427
A flaw was found in Trix, a rich text editor. A remote attacker could exploit this vulnerability by convincing a victim to drag and drop a specially crafted JSON payload into an editor using the Level0InputController. This could bypass sanitization and allow the injection of executable JavaScript...
CVE-2026-81272
Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...
CVE-2026-78276
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78274
Editor Arbitrary File Upload in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78271
Editor Privilege Escalation in FluentCRM Pro = 3.1.12 versions...
CVE-2026-78275
Editor Arbitrary File Deletion in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-81272 WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability
Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...
CVE-2026-81272
CVE-2026-81272 affects the WordPress FluentPlayer Pro plugin in versions 1.3.2 and below , where an Editor-level Broken Access Control flaw allows a user with the Editor role to perform actions they should not be permitted to. The CVSS 3.1 score is 4.9 (MEDIUM) with the vector AV:N/AC:L/PR:H/UI:N...
EUVD-2026-66950
Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...
EUVD-2026-66939
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78276 WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78276
CVE-2026-78276 affects the WordPress Fluent Boards Pro plugin, versions 2.0.11 and earlier , where an Editor-level user can perform PHP Object Injection , leading to potential high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.2 / HIGH ). The vulnerability is network-re...