CVE-2026-115223 Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

CVE-2026-115223

The Smart Popup by Supsystic WordPress plugin versions prior to 2.0.2 is vulnerable to Server-Side Template Injection (SSTI) . The root cause is a logic flaw where a filter intended to strip template delimiters executes before a decoding step that reconstructs them. This allows an authenticated a...

EUVD-2026-111973

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

CVE-2026-115223 Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Dynamic QR Code generator versions = 1.0.1...

WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin myPOS Checkout versions = 1.4.5...

WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin News Kit Elementor Addons versions = 1.5.0...

WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Finale Lite versions = 2.21.0...

WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Media folders versions = 1.1.10...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

💀 PHP2shell One-click weaponized PoC for CVE-2026-109618 & CVE-...

WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Frisbii Pay versions = 1.8.19...

WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sastra Essential Addons for Elementor versions = 1.2.3...

WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Product Catalog Feed by PixelYourSite versions = 3.1.4...

WordPress FV Flowplayer Video Player plugin <= 8.3.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FV Flowplayer Video Player versions = 8.3.4...

WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Social Snap versions = 1.5.4...

WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin 10Web Social Photo Feed versions = 1.5.6...

WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin BuddyPress Xprofile Custom Field Types versions = 1.3.1...

CVE-2026-110185

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image any body field referenced by the ImageHelper node's mix tag' parameter...

CVE-2026-109218

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the addmessage function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation...

WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Extra Fees Plugin for WooCommerce versions = 4.4.0...