CVE-2026-76634 WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...

CVE-2026-73993

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-66672

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

CVE-2026-66583

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

CVE-2026-73993 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-73993 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

EUVD-2026-63312

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-73993

The WordPress FundEngine plugin (versions

CVE-2026-66672

The WordPress Flatastic theme (versions ≤ 2.0) is vulnerable to unauthenticated PHP Object Injection, exploitable over the network without credentials. The Patchstack advisory documents the issue; no exploit code or in-the-wild activity is reported. Affected sites should update to a patched theme...

CVE-2026-66672 WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

EUVD-2026-63303

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

CVE-2026-66583 WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

EUVD-2026-63332

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

CVE-2026-66583

CVE-2026-66583 is an unauthenticated PHP Object Injection vulnerability in the WordPress Forminator plugin , affecting versions

WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Theme FreightCo versions = 1.1.15...

WordPress Copy & Delete Posts plugin < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization vulnerability

Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Duplicate Post versions 1.5.5...

WordPress Clearfy plugin < 2.4.3 - Admin+ PHP Object Injection via Settings Import vulnerability

Admin+ PHP Object Injection via Settings Import vulnerability discovered by Omar Elshopky in WordPress Plugin Clearfy Cache versions 2.4.3...

WordPress Newsletters plugin < 4.16 - Unauthenticated PHP Object Injection via Date Form Field vulnerability

Unauthenticated PHP Object Injection via Date Form Field vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Newsletters versions 4.16...

WordPress Ajax Search Lite plugin < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability

Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability discovered by Jakub Herman in WordPress Plugin Ajax Search Lite versions 4.14.5...

WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Flatastic versions = 2.0...