CVE-2026-65509: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in wpDataTables = 7.5.1 versions...

CVE-2026-66703: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in MailOptin = 1.2.78.0 versions...

CVE-2026-65553: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 = 2.1.3 versions...

CVE-2026-66470: Missing Authorization

Subscriber Broken Access Control in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66695: Path Traversal: '.../...//'

Unauthenticated Path Traversal in W3 Total Cache = 2.10.2 versions...

CVE-2026-5430: Improper Verification of Cryptographic Signature

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this...

CVE-2026-65552: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...

CVE-2025-13909: Exposure of Sensitive Information to an Unauthorized Actor

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...

CVE-2026-65570: Authentication Bypass by Spoofing

Unauthenticated Bypass Vulnerability in Login with phone number = 1.8.70 versions...

CVE-2026-66701: Missing Authorization

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

CVE-2026-65571: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in 69 Clothing = 1.2.11.1 versions...

CVE-2026-67871: Buffer Copy without Checking Size of Input

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, addressspacebs.c, sopcnodemgthelperinternal.c, and toolkittestserver...

CVE-2026-28111: Incorrect Privilege Assignment

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

CVE-2026-3418: Unrestricted Upload of File with Dangerous Type

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

CVE-2026-19127: Insufficient Verification of Data Authenticity

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal LTD redemption codes, an unauthenticated attacker...

CVE-2026-65520: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...

CVE-2026-66696: Insertion of Sensitive Information Into Sent Data

Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...

CVE-2026-65547: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

CVE-2026-66707: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Facebook for WooCommerce = 3.7.5 versions...

CVE-2026-3415: Improper Restriction of Recursive Entity References in DTDs

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior...