CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32554 WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in WooBeWoo Product Filter Pro = 3.1.8 versions...

Elementor-Pro-Unauthenticated-Arbitrary-File-Upload-to-RCE

Autor do Exploit: Abdualhadi Khalifa https://x.com/absholi7ly Versão: Elementor Pro = 4.2.1 Testado em: WordPress + Elementor Pro 4.2.1 Windows / Laragon / Apache CVE: CVE-2026-32475 Créditos: Vulnerabilidade descoberta por Tin Pham TF1T por meio do Programa de Bug Bounty da Patchstack Categoria:...

CVE-2026-78270

Author SQL Injection in FluentCRM Pro = 3.1.12 versions...

CVE-2026-78272

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

CVE-2026-78279

Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...

CVE-2026-78278

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78277

Subscriber Server Side Request Forgery SSRF in FluentCRM Pro = 3.1.12 versions...

CVE-2026-66587

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

CVE-2026-66585

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

CVE-2026-32476

Unauthenticated Cross Site Scripting XSS in Brave Conversion Engine PRO = 0.8.6 versions...

CVE-2026-32477

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

CVE-2026-32558

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress = 8.9.1 versions...

CVE-2026-66587

WP Cafe Pro is a WordPress plugin affected by an unauthenticated Local File Inclusion (LFI) vulnerability in versions prior to 3.0.15 . Discovered by Ananda Dhakal via Patchstack, the flaw requires no authentication or user interaction and is scored CVSS 9.8 (Critical) with full confidentiality, ...

CVE-2026-66585

CVE-2026-66585 is an unauthenticated sensitive data exposure in the WP Cafe Pro WordPress plugin, affecting versions below 3.0.15 . The vulnerability allows remote attackers with no privileges to access sensitive data, yielding a CVSS 3.1 base score of 7.5 (HIGH) with high confidentiality impact ...

CVE-2026-66587 WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

CVE-2026-66585 WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

EUVD-2026-64806

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

EUVD-2026-64805

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

EUVD-2026-64804

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress = 8.9.1 versions...