CVE-2026-66620

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-32474

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

CVE-2026-32553

Unauthenticated Server Side Request Forgery SSRF in OttoKit = 1.1.35 versions...

CVE-2026-32481

Unauthenticated Broken Authentication in Ezoic = 2.22.11 versions...

CVE-2026-32472

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

CVE-2026-32473

Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...

Exploit for CVE-2026-15748

CVE-2026-15748 - Forminator Forms Unauthenticated RCE Cra...

CVE-2026-32468

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

CVE-2026-32467

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-28567

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28191

Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...

CVE-2026-28569

Unauthenticated Cross Site Scripting XSS in SSL Zen = 4.7.43 versions...

EUVD-2026-60820

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...

EUVD-2026-60819

Unauthenticated SQL Injection in Readabler 2.0.18 versions...

CVE-2026-74015 WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability

Unauthenticated SQL Injection in Readabler 2.0.18 versions...

CVE-2026-74012

The WordPress TaxoPress plugin (versions ≤ 3.51.0) is vulnerable to PHP Object Injection via its Editor component, exploitable over the network with low privileges, potentially leading to full confidentiality, integrity, and availability impact (CVSS 8.8). PatchStack is the CNA. No exploitation e...

CVE-2026-74008 WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.24 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24...

CVE-2026-74008

The WordPress "Shortcodes and extra features for Phlox theme" plugin (auxin-elements) version 2.17.22 and earlier exposes sensitive data without authentication, rated CVSS 5.3 (MEDIUM). CISA SSVC shows no known exploitation. No patch version is mentioned in the provided documents; update to a new...

CVE-2026-74007 WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery plugin <= 1.16.20 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery = 1.16.20 versions...

CVE-2026-74007

The WordPress 3D FlipBook plugin (versions ≤ 1.16.20) exposes sensitive data to unauthenticated users over the network (CVSS 5.3). No specific technical details, patch version, or evidence of in-the-wild exploitation are provided in the documents.