EUVD-2026-76197

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

CVE-2026-62105 WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

CVE-2026-62103 WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

CVE-2026-62105

CVE-2026-62105 affects the ThemeREX Addons WordPress plugin in versions prior to 2.45.0 , introducing an unauthenticated PHP Object Injection vulnerability. The flaw is exploitable over the network with low complexity, requires no privileges or user interaction, and is scored CVSS 3.1: 9.8 (Criti...

CVE-2026-62140 WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Quiz And Survey Master = 11.2.5 versions...

EUVD-2026-76216

Unauthenticated Insecure Direct Object References IDOR in Quiz And Survey Master = 11.2.5 versions...

CVE-2026-62140

CVE-2026-62140 affects the WordPress plugin Quiz And Survey Master in versions

WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

WordPress Masteriyo - LMS plugin = 3.4.0 - PHP Object Injection vulnerability discovered by 20kilograma in WordPress Plugin Masteriyo - LMS versions = 3.4.0...

WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by nh4tvd in WordPress Plugin ThemeREX Addons versions 2.45.0...

ROOT-APP-NPM-CVE-2021-23329 CVE-2021-23329 in nested-object-assign - Patched by Root

Root has patched CVE-2021-23329 in the nested-object-assign package for Root:npm. Multiple fixed versions available...

WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LueRader in WordPress Plugin Everest Forms versions = 3.6.0...

WordPress Site Reviews plugin 7.2.2-8.2.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Site Reviews versions 7.2.2-8.2.2...

WordPress Weaver Show Posts plugin < 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Do Xuan Trung in WordPress Plugin Weaver Show Posts versions 1.8.1...

Exploit for CVE-2026-82222

CVE-2026-82222 — GiveWP Unauthenticated PHP Object Injection →...

WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Sybre Waaijer in WordPress Plugin Slim SEO versions = 4.10.0...

CVE-2026-86779 Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...

CVE-2026-88046

A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows an attacker to bypass configured directory restrictions by including parent-directory segments e.g., '..' in source object names. When a specially crafted source object is uploaded or copied, it can...

CVE-2026-11496 Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

CVE-2026-81915: Missing Authorization

Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...

PT-2026-89913

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description A mass assignment issue exists in the editer objet action. Unauthenticated attackers can write arbitrary rows to any SQL table that does not have a champs editables allowlist by providing a controlled...