EUVD-2026-96460

Subscriber PHP Object Injection in Angio = 1.1.1 versions...

CVE-2026-62021 WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Angio = 1.1.1 versions...

EUVD-2026-96453

Unauthenticated PHP Object Injection in CleanSkin = 1.5.0 versions...

CVE-2026-42723

The CleanSkin WordPress theme, versions

CVE-2026-42723 WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in CleanSkin = 1.5.0 versions...

CVE-2026-42718 WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booster for WooCommerce = 8.4.0 versions...

CVE-2026-42719

The WordPress Dynamic User Directory plugin (versions

CVE-2026-42718

The Booster for WooCommerce WordPress plugin (versions

EUVD-2026-96451

Subscriber PHP Object Injection in Dynamic User Directory = 2.4 versions...

CVE-2026-42719 WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Dynamic User Directory = 2.4 versions...

EUVD-2026-96450

Unauthenticated PHP Object Injection in Booster for WooCommerce = 8.4.0 versions...

EUVD-2026-96448

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway = 4.8.2 versions...

CVE-2026-42716

The Payever - WooCommerce Gateway plugin for WordPress (versions

CVE-2026-42716 WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway = 4.8.2 versions...

CVE-2026-108591

InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...

EUVD-2026-96403

InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...

CVE-2026-108591

InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...

CVE-2026-108591 InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool

InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...

CVE-2026-108591

InnoShop version 0.9.2 is vulnerable to a local file disclosure vulnerability. Authenticated administrators with files_create permissions can read sensitive server files by abusing the AI Core MCP file_upload tool's source argument. By providing file:// or php:// stream wrappers to the file_get_c...

CVE-2026-62044 WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13...