CVE-2026-32470

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-32470

The WordPress FundEngine plugin (versions ≤ 1.7.9) is vulnerable to unauthenticated PHP Object Injection, discovered by researcher daroo. CVSS 3.1 scores this critical (9.8) with network attack vector, no privileges or user interaction required, impacting confidentiality, integrity, and availabil...

EUVD-2026-60901

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-32465 WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-32465 WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-32465

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-32465

Essential Real Estate is a WordPress plugin affected by a PHP Object Injection vulnerability in versions 5.3.3 and below . The flaw is located in the plugin's customer-facing functionality, allowing an authenticated low-privilege user to inject a malicious PHP object over the network without user...

UBUNTU-CVE-2026-23929

Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Jakub Herman in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...

WordPress Contact Form, Survey, Quiz & Popup Form Builder - ARForms plugin <= 1.8.5 - Unauthenticated PHP Object Injection vulnerability

WordPress Contact Form, Survey, Quiz & Popup Form Builder - ARForms plugin = 1.8.5 - Unauthenticated PHP Object Injection vulnerability discovered by Krzysztof Zając - CERT PL in WordPress Plugin ARForms Form Builder versions = 1.8.5...

WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin OptionTree versions = 2.7.3...

WordPress Forminator Forms plugin <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability discovered by se1en in WordPress Plugin Forminator versions = 1.55.0.2...

WordPress Turnkey bbPress by WeaverTheme plugin <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Luk6785 in WordPress Plugin Turnkey bbPress versions = 1.7.1...

WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by dutafi in WordPress Plugin RegistrationMagic versions = 6.0.9.7...

WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Popup by Supsystic versions = 1.13.0...

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Ultimate Maps by Supsystic versions 1.5.0...

WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by luc in WordPress Plugin Modal Survey versions = 2.0.2.2.3...

WordPress Podlove Podcast Publisher plugin <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter vulnerability

Authenticated Contributor+ PHP Object Injection to Arbitrary File Deletion via 'unfurldata' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Podlove Podcast Publisher versions = 4.5.3...

WordPress Password Protect WordPress Lite plugin <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update vulnerability

Insecure Direct Object Reference to Authenticated Contributor+ Password Protected Post Password Update vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin PPWP versions = 1.9.20...

WordPress Online Scheduling and Appointment Booking System - Bookly plugin <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter vulnerability

WordPress Online Scheduling and Appointment Booking System - Bookly plugin = 27.7 - Authenticated Staff+ Insecure Direct Object Reference to Sensitive Information Exposure via 'paramsid' Parameter vulnerability discovered by Raihan Adi Arba in WordPress Plugin Bookly versions = 27.7...