CVE-2026-78175

Tutor LMS (WordPress eLearning plugin) is vulnerable to PHP Object Injection in versions up to and including 4.0.7 via the withdraw_method_field parameter of the tutor_save_withdraw_account AJAX handler. The handler relies solely on a nonce without capability checks, and a flaw in how esc_sql() h...

CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the issafewidgetinstance function. This is due to insufficient protection in issafewidgetinstance, which can be bypassed because PHP fires magic methods during its...

CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the issafewidgetinstance function. This is due to insufficient protection in issafewidgetinstance, which can be bypassed because PHP fires magic methods during its...

CVE-2026-85200 GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

CVE-2026-85200 GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

EUVD-2026-76829

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

CVE-2026-85200

GEO my WP is a WordPress plugin vulnerable to an unauthenticated Local File Inclusion (LFI) in all versions up to and including 4.5.5.3 , via the gmw_posts_locator_ajax_info_window_loader function. An attacker can include and execute arbitrary .php files on the server, enabling bypass of access c...

CVE-2026-85200 GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

CVE-2026-82845

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

EUVD-2026-76794

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...

CVE-2026-84099

The wpstorecart WordPress plugin (versions

CVE-2026-84099 IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...

CVE-2026-84099 IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...

CVE-2026-82845

The Masteriyo LMS WordPress plugin (versions before 3.4.1 ) is vulnerable to PHP Object Injection due to the failure to prevent deserialization of user-supplied values held as metadata. An attacker with a minimal account can inject arbitrary PHP objects, leveraging a class in a bundled library to...

EUVD-2026-76787

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

EUVD-2026-76784

The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code...

CVE-2026-82845 Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

Exploit for Improper Access Control in Ollyo Helix3

CVE-2026-49049 This repository contains a Python-based scanne...

PT-2026-90570

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

Linux Distros Unpatched Vulnerability : CVE-2024-58382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service...