WordPress Unlimited Elements For Elementor plugin < 2.0.20 - Subscriber+ PHP Object Injection vulnerability

Subscriber+ PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 2.0.20...

Security update for php-composer2

This update for php-composer2 fixes the following issues: CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure bsc1271504. CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. CVE-2026-59946: packa...

SUSE-SU-2026:4283-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure bsc1271504. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. - CVE-2026-59946:...

EUVD-2026-84333

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

CVE-2026-9231

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 6.8.0 . The root cause lies in the wte_get_template function, which allows authenticated attackers with contributor-level access or hig...

CVE-2026-91827

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-91827 Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-91827 Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-91827

The Ninja Forms WordPress plugin (version 3.15.3 ) is vulnerable to unauthenticated PHP Object Injection . User-submitted form field values are deserialised without sanitisation when an administrator exports form submissions to CSV . Exploitation requires user interaction (an admin performing the...

EUVD-2026-84283

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

Exploit for CVE-2026-19658

CVE-2026-19658 — Give Tributes Unauthenticated PHP Object Inje...

CVE-2026-19658

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-19658

Give Tributes WordPress plugin (≤ 2.3.1 ) is vulnerable to PHP Object Injection via deserialization of untrusted input in the give_tributes_ecard_notify[recipient][personalized][] parameter, exploitable by unauthenticated attackers. No known POP chain exists within the plugin itself, so impact de...

EUVD-2026-84269

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-19658 Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-19658 Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

PT-2026-96645

Name of the Vulnerable Software and Affected Versions Give Tributes versions prior to 2.3.2 Description The Give Tributes plugin for WordPress is susceptible to PHP Object Injection through the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The...

CVE-2026-37603

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

CVE-2026-95500: Unrestricted Upload of File with Dangerous Type

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...

CVE-2026-91827: Deserialization of Untrusted Data

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...