CVE-2026-91051

The EWWW Image Optimizer WordPress plugin versions before 8.8.0 (specifically versions 8.6.0 - 8.7.7 ) is vulnerable to PHP Object Injection . Authenticated users with author-level permissions can store a serialized value in a post meta field (specifically 'eio_page_settings' ). When the post is ...

EUVD-2026-89639

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

CVE-2026-75823

The User Frontend WordPress plugin (versions 3.5.29 through 4.3.11 ) contains a vulnerability allowing unauthenticated privilege escalation . The root cause is a failure to prevent tampering with the role assigned by the plugin's registration form. This specifically affects installations where a ...

CVE-2026-75823 WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

CVE-2026-75823 WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

AZL-105639 CVE-2026-103111 affecting package php 8.3.33-1

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data...

PHP-FPM Path Info Buffer Underflow - Remote Code Execution

In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgisplitpathinfo directive, a crafted request with an empty PATHINFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote...

CLEANSTART-2026-AP36720 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the tempo package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

EUVD-2026-89469

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...

CVE-2026-96833: Deserialization of Untrusted Data

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...

CVE-2026-103592: Use of Less Trusted Source

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...

CVE-2026-93651: Deserialization of Untrusted Data

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...

PT-2026-103189

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96343: Deserialization of Untrusted Data

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

PT-2026-103188

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

CVE-2026-96344: Deserialization of Untrusted Data

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

PT-2026-103182

Contributor PHP Object Injection in Go Live Update Urls = 7.0.8 versions...

PT-2026-103499

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-91051: Deserialization of Untrusted Data

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

PT-2026-103039

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...