115760 matches found
CVE-2026-40753 WordPress EasyMeals theme <= 1.5.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in EasyMeals = 1.5.1 versions...
CVE-2026-39589
The CVE-2026-39589 affects the WordPress Webenvo theme
CVE-2026-25439
CVE-2026-25439 affects the WordPress Booknetic plugin up to version 4.8.5, with unauthenticated broken authentication leading to account takeover. The CVSSv3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a base score of 8.1 (HIGH). Documented impact includes high confidentiality, integrit...
CVE-2026-24610 WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in MetForm Pro = 3.9.1 versions...
CVE-2026-12115 Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import
The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...
WordPress Slimstat Analytics plugin <= 5.4.11 - SQL Injection vulnerability
SQL Injection vulnerability discovered by hhhai in WordPress Plugin Slimstat Analytics versions = 5.4.11...
CVE-2026-8494 Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with...
PT-2026-50274
Unauthenticated PHP Object Injection in ThemeREX Addons = 2.36.1.1 versions...
The vulnerability of Adobe Experience Manager’s content and media management system lies in its lack of measures to protect the structure of web pages. This allows attackers to inject malicious scripts into vulnerable form fields.
The vulnerability of the Adobe Experience Manager content and media management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to inject malicious scripts into vulnerable fields within the system...
The vulnerability of Adobe Experience Manager’s content and media management system lies in its lack of measures to protect the structure of web pages. This allows attackers to inject malicious scripts into vulnerable form fields.
The vulnerability of the Adobe Experience Manager content and media management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to inject malicious scripts into vulnerable fields within the system...
PT-2026-50270
Unauthenticated Local File Inclusion in Joly = 1.22.0 versions...
PT-2026-50414
Name of the Vulnerable Software and Affected Versions Fusion Builder versions prior to 3.15.5 Description A path traversal issue allows users with the Contributor role to delete arbitrary files on the server. Recommendations Limit user roles as a temporary mitigation measure. At the moment, there...
PT-2026-50550
Name of the Vulnerable Software and Affected Versions CakePHP versions prior to 4.5.11 CakePHP versions 4.6.0 through 4.6.3 CakePHP versions 5.0.0 through 5.1.6 CakePHP versions 5.2.0 through 5.2.12 CakePHP versions 5.3.0 through 5.3.5 Description The getElementFileName function in the View class...
PT-2026-50544
Name of the Vulnerable Software and Affected Versions PHP Standard Library PSL versions 6.1.0 through 6.1.1 PHP Standard Library PSL version 6.2.0 Description The PslH2ServerConnection function does not validate that the total bytes received in DATA frames match the content-length header declared...
PT-2026-50405
Unauthenticated PHP Object Injection in Eldon = 1.4.1 versions...
@0xwork/connect (0.1.8), @a5c-ai/agent-platform (>=5.0.1-staging.016f0b0e8119, <=5.0.1-staging.ffad3b46492e) +261 more potentially affected by CVE-2026-54326 via @earendil-works/pi-coding-agent (>=0.74.0, <=0.78.0)
@earendil-works/pi-coding-agent NPM version =0.74.0, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.078c111a306a, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.3abdf9534c25, =0.6.4, =0.3.1, =0.4.7, =2026.5.12-zh,...
CVE-2026-48788 Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting XSS vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and...
CVE-2026-48779 ws: Memory exhaustion DoS from tiny fragments and data chunks
ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to but not including 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally...
CVE-2026-49073 WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3...