CVE-2026-103831

The TrueLayer Magento 2 plugin contains an insecure deserialization vulnerability in the Psr16CacheAdapter component. The root cause is the use of PHP's native unserialize() function without restricting allowed classes when retrieving data from the cache. An attacker with the ability to write man...

WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by William Honnér in WordPress Plugin Social Share Icons & Social Share Buttons versions = 3.7.5...

CVE-2026-84370

A flaw was found in SVGO SVG Optimizer, a Node.js library for optimizing SVG files. The removeScripts plugin, intended to filter executable links, incompletely processes namespace-prefixed SVG anchor elements and fails to remove ASCII control characters before validating URL schemes. A remote...

CVE-2026-39728

Unauthenticated Server Side Request Forgery SSRF in Instapage Plugin = 3.7.2 versions...

CVE-2026-105070

The WordPress Salon booking system plugin versions

CVE-2026-104405 WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in GiveWP = 4.17.0 versions...

CVE-2026-104405

The GiveWP plugin for WordPress (versions

CVE-2026-102387 WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Xserver Migrator = 1.6.6 versions...

CVE-2026-95526

The WordPress BEAR plugin (versions

CVE-2026-62072 WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Progress Planner = 1.10.0 versions...

CVE-2026-39780 WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Youzify = 1.3.7 versions...

CVE-2026-39771 WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in Buddyboss Platform = 3.1.0 versions...

CVE-2026-39771

The Buddyboss Platform WordPress plugin (versions

CVE-2026-39761 WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Meta Box AIO = 3.7.1 versions...

CVE-2026-39746 WordPress Booknetic plugin <= 4.8.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Booknetic = 4.8.5 versions...

CVE-2026-39728 WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in Instapage Plugin = 3.7.2 versions...

CVE-2026-39728 WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in Instapage Plugin = 3.7.2 versions...

CVE-2026-39728

The Instapage Plugin for WordPress is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) in versions

stylesmuggler-adobe-patches

disrex/stylesmuggler-adobe-patches Un plugin Composer che applica la correzione ufficiale APSB26-146 di Adobe CVE-2026-75650, riferimento interno VULN-39341 per la zero-day StyleSmuggler a Magento Open Source e Mage-OS , automaticamente, rilevando la versione installata. Corregge i pacchetti...

CVE-2026-5229

CVE-2026-5229 CVE-2026-5229: Form Notify Auth Bypass via LINE OAuth Callback CVSS 9.8 Form Notify — LINE OAuth Authentication Bypass Scanner Plugin: Form Notify form-notify Vulnerability Type: Unauthenticated LINE OAuth Authentication Bypass → Account Takeover CVSS Score: 9.8 Critical CVSS Vector...