CVE-2026-81792 WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.4 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Product Catalog Enquiry for WooCommerce by MultiVendorX = 6.1.4 versions...

EUVD-2026-72643

Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...

CVE-2026-81792

Unauthenticated privilege escalation in the WordPress plugin Product Catalog Enquiry for WooCommerce by MultiVendorX , affecting versions ≤ 6.1.4 . An attacker with no prior access (no credentials, no user interaction) can escalate privileges over the network with low complexity. The CVSS 3.1 sco...

CVE-2026-84820 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...

EUVD-2026-72644

Unauthenticated Privilege Escalation in Product Catalog Enquiry for WooCommerce by MultiVendorX = 6.1.4 versions...

CVE-2026-84820 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...

CVE-2026-81792 WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.4 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Product Catalog Enquiry for WooCommerce by MultiVendorX = 6.1.4 versions...

CVE-2026-84820

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin versions

redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free

A flaw was found in Redis. This vulnerability, a use-after-free, exists within the tlsProcessPendingData function, which manages the Transport Layer Security TLS pending-data list when Redis is configured with TLS support. A remote, unauthenticated attacker could exploit this to execute...

CVE-2026-48962

Resumen Una vulnerabilidad de inyección en eval en File::GlobMapper::getFiles permite a cualquier atacante que pueda controlar el argumento fileglob de salida pasado a IO::Compress::Gzip::gzip, IO::Compress::Zip::zip, o cualquier función relacionada, ejecutar código Perl arbitrario en el contexto...

WordPress Beaver Builder Page Builder – Drag and Drop Website Builder plugin <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kishan Vyas in WordPress Plugin Beaver Builder versions = 2.10.3.1...

CVE-2026-23550

root@kitploit: ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ███████╗ ███████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ╚════██╗╚════██╗██╔════╝ ██╔════╝██╔═████╗ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ █████╔╝ █████╔╝███████╗...

WordPress Event Tickets and Registration plugin <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update vulnerability

Missing Authorization to Unauthenticated Stripe Credentials Update vulnerability discovered by h0xilo in WordPress Plugin Event Tickets versions = 5.27.4...

CVE-2026-11349

Modern Events Calendar Lite = 7.33.0 — Inyección SQL no autenticada mediante meclistloadmore attsinclude / attsexclude Resumen...

React2Shell_CVE-2025-55182

Exploit modular CVE-2025-55182 con bypass de WAF Un script de Python que proporciona un shell interactivo para explotar la vulnerabilidad crítica de RCE CVE-2025-55182 en aplicaciones vulnerables de React Server Components y Next.js. Este exploit apunta a la falla de deserialización que permite l...

389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

CVE-2026-55579

CVE-2026-55579 — Pheditor Hardcoded Default Password RCE -critical TL;DR: Pheditor all versions ships with a hardcoded default administrator password admin embedded in its source code. There is no forced password change on first login, only a visual warning. Any unauthenticated attacker can log i...

389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...