CVE-2026-117607 Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via importlanguage.php containing a .inc file, then request it through the languag...

CVE-2026-117607

The Xerte Online Toolkits software (versions through 3.15.5 ) is vulnerable to Remote Code Execution (RCE) . This issue allows authenticated users with system permissions to execute PHP by importing a crafted language pack. The root cause involves the import_language.php functionality, where an a...

CVE-2026-117607 Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via importlanguage.php containing a .inc file, then request it through the languag...

CVE-2026-117607 Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via importlanguage.php containing a .inc file, then request it through the languag...

CVE-2026-109218: kleor Contact Manager: The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,…

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the addmessage function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation...

PT-2026-132245

Name of the Vulnerable Software and Affected Versions BuddyPress Xprofile Custom Field Types versions prior to 1.3.2 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated attackers with subscriber-level access or higher can inject a P...

C97net qEngine CMS arbitrary file upload vulnerability

C97net qEngine CMS versions 6.0.0 and earlier, Kemana Directory versions 1.5.6 and earlier, and Cart Engine versions 3.0.0 and earlier contain an arbitrary file upload vulnerability. This vulnerability arises from unrestricted file uploads in the image management field; users with edit permission...

CVE-2026-54453: OpenCATS: OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in SettingsUI manageProfessional accepts administrator-controlled license key input that is reconstructed into a...

PT-2026-127731

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import language.php containing a .inc file, then request it through the langua...

PT-2026-132246

Name of the Vulnerable Software and Affected Versions myPOS Checkout versions prior to 1.4.6 Description The myPOS Checkout plugin for WordPress allows authenticated attackers with shop manager-level access or higher to perform PHP Object Injection. This occurs due to the deserialization of...

PT-2026-132247

Name of the Vulnerable Software and Affected Versions News Kit Elementor Addons versions prior to 1.5.1 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated attackers with subscriber-level access or higher can inject a PHP Object...

CVE-2026-110185: bitpressadmin: The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for…

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image any body field referenced by the ImageHelper node's mix tag' parameter...

PT-2026-129212

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.1.0 Description An unauthenticated installer endpoint install/checkConfiguration.php fails to escape request parameters, such as webSiteRootURL, when interpolating them into single-quoted PHP string literals to creat...

PT-2026-132252

Name of the Vulnerable Software and Affected Versions Product Catalog Feed by PixelYourSite versions prior to 3.1.5 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated attackers with shop manager-level access or higher can inject a...

PT-2026-132255

Name of the Vulnerable Software and Affected Versions 10Web Social Photo Feed versions prior to 1.5.7 Description The 10Web Social plugin for WordPress allows authenticated attackers with contributor-level access and above to perform PHP Object Injection. This occurs due to the deserialization of...

CVE-2026-106971

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack input when the application runs on 32-bit PHP...

CVE-2026-117607: thexerteproject xerteonlinetoolkits: Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users…

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via importlanguage.php containing a .inc file, then request it through the languag...

CVE-2026-1928: rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in…

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with...

VulnCheck KEV: CVE-2026-103688

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that...

PT-2026-127806

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with...