CVE-2026-32563

CVE-2026-32563 is a PHP Object Injection vulnerability in the ACPT (Pro) – Custom Post Types Plugin for WordPress , affecting versions ≤ 2.0.63 . The vulnerability requires Subscriber -level access as stated in the description, though the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates Pr...

CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-78259 WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in WPLegalPages = 3.7.0 versions...

CVE-2026-32561 WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...

CVE-2026-32561 WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...

CVE-2026-32560 WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...

CVE-2026-32560 WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...

CVE-2026-32559 WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-32560

MagicAI for WordPress (AI Text, Image, Chat, Code, and Voice Generator) plugin versions ≤ 1.4 are affected by a Local File Inclusion (LFI) vulnerability accessible to authenticated users with the Subscriber role. The vulnerability is rated CVSS 8.8 (HIGH) by Patchstack, with a network attack vect...

CVE-2026-32559 WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-32556 WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...

CVE-2026-32556 WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...

CVE-2026-32555 WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability

Unauthenticated SQL Injection in Boost = 2.0.4 versions...

CVE-2026-32554 WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in WooBeWoo Product Filter Pro = 3.1.8 versions...

CVE-2026-32554 WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in WooBeWoo Product Filter Pro = 3.1.8 versions...

CVE-2026-32554

WooBeWoo Product Filter Pro (WordPress plugin) versions up to and including 3.1.8 are affected by an unauthenticated SQL injection vulnerability, rated CVSS 9.3 (CRITICAL) by Patchstack. The vulnerability is exploitable over the network with low complexity and no user interaction required, with a...

CVE-2026-32555 WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability

Unauthenticated SQL Injection in Boost = 2.0.4 versions...

CVE-2026-27364 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

CVE-2026-78284 WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

CVE-2026-78284 WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...