EUVD-2026-51410

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks...

CVE-2026-14830

The CVE describes a vulnerability in the FlxWoo WordPress plugin prior to version 3.1.1 where the payment status of a checkout session is not verified with the payment processor before marking an order as paid. This allows unauthenticated attackers to complete WooCommerce orders without payment. ...

CVE-2026-14333

CVE-2026-14333 affects the Demi WordPress plugin (before 0.0.7). The vulnerability arises because full-site backup archives are stored in a publicly accessible location with a predictable filename and without access protection. This enables unauthenticated attackers to download complete backups, ...

CVE-2026-14319 GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details...

EUVD-2026-51407

The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled...

CVE-2026-14317

The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled...

CVE-2026-16236

CVE-2026-16236 affects Realtyna Organic IDX plugin for WordPress (

CVE-2026-16236 Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload

The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages function combined with an insufficient authorization check on the getkeys AJAX handler a...

EUVD-2026-51405

The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages function combined with an insufficient authorization check on the getkeys AJAX handler a...

CVE-2026-16236

The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages function combined with an insufficient authorization check on the getkeys AJAX handler a...

CVE-2026-14483 Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint...

CVE-2026-14483

The CVE-2026-14483 entry describes an unauthenticated Arbitrary File Upload in the Realtyna Organic IDX plugin + WPL Real Estate (

PT-2026-66760

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.6.1 Description An open redirect issue exists in the 'exit.php' endpoint. Unauthenticated attackers can redirect users to arbitrary external sites by providing a malicious Base64-encoded url parameter. This occu...

PT-2026-66743

Name of the Vulnerable Software and Affected Versions Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions prior to 6.2.9 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers...

Oracle Linux 9 : vim (ELSA-2026-47982)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47982 advisory. - RHEL-203985 CVE-2026-59858 vim: arbitrary Ex command execution in C omni-completion - RHEL-201197 CVE-2026-59856 vim: potential command execution in...

CVE-2026-68501

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

CVE-2026-68500

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...

CVE-2026-68501

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

CVE-2026-68501 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

CVE-2026-68501 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...