1038 matches found
CVE-2026-25354
CVE-2026-25354 affects the WordPress Reebox theme (versions prior to 1.4.8). The Root Cause is improper neutralization of input during web page generation, resulting in a Reflected XSS vulnerability. Impact per sources is that arbitrary scripts can be injected into web pages when a user visits a ...
CVE-2026-25358 WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through 2.8.2...
CVE-2026-25352
CVE-2026-25352 is a confirmed Reflected XSS in the WordPress theme MyDecor. Affected products: MyDecor versions prior to 1.5.9. The entry documents a reflected cross-site scripting flaw arising from improper input neutralization during web page generation, enabling a reflected payload to execute ...
CVE-2026-25350 WordPress Miti theme < 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Miti miti allows Reflected XSS.This issue affects Miti: from n/a through 1.5.3...
CVE-2026-24989 WordPress SUMO Affiliates Pro plugin < 11.4.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through 11.4.0...
CVE-2026-4716
Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...
CVE-2026-4723
CVE-2026-4723 describes a use-after-free in the JavaScript Engine component affecting Firefox versions older than 149. The connected documents consistently identify the affected area as the JavaScript engine and indicate the vulnerability is limited to Firefox
WordPress The Grid plugin < 2.8.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Phat RiO in WordPress Plugin The Grid versions 2.8.0...
WordPress Tasty Daily theme < 1.27 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Tasty Daily versions 1.27...
WordPress Pendulum theme < 3.1.5 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Pendulum versions 3.1.5...
WordPress Vex theme < 1.2.9 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Vex versions 1.2.9...
WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Kargo Takip versions 0.2.4...
WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Plugin Fusion Builder versions 3.15.0...
CVE-2026-23942 affecting package erlang for versions less than 26.2.5.18-1
CVE-2026-23942 affecting package erlang for versions less than 26.2.5.18-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-32440 WordPress WP Food plugin < 2.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Ex-Themes WP Food wp-food allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Food: from n/a through 2.7.1...
CVE-2026-32426
The CVE-2026-32426 entry describes a Local File Inclusion (LFI) vulnerability in the WordPress plugin Medilazar Core (themelexus) prior to version 1.4.7 . The root cause is improper control of the filename for include/require in PHP, effectively enabling LFI. Affected software: Medilazar Core
CVE-2026-32426
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in themelexus Medilazar Core medilazar-core allows PHP Local File Inclusion.This issue affects Medilazar Core: from n/a through 1.4.7...
CVE-2026-32390 WordPress Nanosoft theme < 1.3.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in linethemes Nanosoft nanosoft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nanosoft: from n/a through 1.3.2...
WordPress Datalogics Ecommerce Delivery plugin < 2.6.60 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Datalogics Ecommerce Delivery versions 2.6.60...