CVE-2026-97643: Improper Neutralization of Input During Web Page Generation

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's givewpcampaigngrid shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied...

CVE-2026-93932: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12...

CVE-2026-93933: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4...

CVE-2026-94421: Improper Neutralization of Input During Web Page Generation

The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-93935: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15...

CVE-2026-93941: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2...

CVE-2026-93938: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7...

CVE-2026-93937: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0...

CVE-2026-94538: Missing Authorization

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-96743: Improper Neutralization of Input During Web Page Generation

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-87781: Improper Neutralization of Special Elements used in an SQL Command

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-66567: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Anesta = 1.5.3 versions...

CVE-2026-66480: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0...

CVE-2026-78534: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Educavo = 3.4.2 versions...

CVE-2026-108651: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerat...

CVE-2026-108669: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-privileged authenticated attackers can supply knowledge base ids to the GET /airag/knowledge/embedding/search endpoint to...

CVE-2026-108549: Missing Authentication for Critical Function

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhooksecret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an...

CVE-2026-108474: Improper Neutralization of Special Elements used in an SQL Command

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...

CVE-2026-42704: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Kids Care = 3.2.4 versions...

CVE-2026-42632: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Qode Real Estate = 1.1.7.3 versions...

CVE-2026-62027: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Team Section Block = 2.0.4 versions...

CVE-2026-62024: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in CodeBard Help Desk = 1.1.2 versions...

CVE-2026-62031: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in uListing = 2.2.0 versions...

CVE-2026-62035: Missing Authorization

Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...

CVE-2026-42716: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway = 4.8.2 versions...

CVE-2026-42711: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Slider by 10Web = 1.2.63 versions...

CVE-2026-42706: Missing Authorization

Unauthenticated Broken Access Control in DK = 3.2.1 versions...

CVE-2026-93945: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0...

CVE-2026-93934: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13...

CVE-2026-78531: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Jacqueline = 2.22 versions...

CVE-2026-78535: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Photolia = 1.0.3 versions...

CVE-2026-108550: Incorrect Authorization

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth...

CVE-2026-108661: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign any tenant's owner to a member, includin...

CVE-2026-108642: Authorization Bypass Through User-Controlled Key

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite...

CVE-2026-107794: Integer Underflow (Wrap or Wraparound)

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call avextend av, len-1 . On an empty list, this undeflows, and avextend will allocate an array with 2^32 slots, leading to memory exhaustion. Note that a similar issue was...

CVE-2026-108674: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryById with an entry id to obtain interna...

CVE-2026-108611: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /airag/word/delete with an id parameter to permanently remove a...

CVE-2026-108640: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes,...

CVE-2026-100147: Improper Neutralization of Input During Web Page Generation

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shippingfirstname' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-107373: Out-of-bounds Read

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl TSTDSTRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string SvPVnolen$arg, SvCUR$arg However, evaluation order for C++ arguments is not specified, and some compilers may produce code...

CVE-2026-105885: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62...

CVE-2026-105977: Authorization Bypass Through User-Controlled Key

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators...

CVE-2026-105995: Exposure of Sensitive Information to an Unauthorized Actor

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens...

CVE-2026-108551: Improper Control of Generation of Code

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

CVE-2026-108547: Authorization Bypass Through User-Controlled Key

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted...

CVE-2026-108162: Use of Less Trusted Source

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn,...

CVE-2026-108603: Improper Limitation of a Pathname to a Restricted Directory

slide-maker through 5.8.0 contains a path traversal vulnerability in generateimagesopenai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked...

CVE-2026-108591: External Control of File Name or Path

InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...

CVE-2026-104803: Improper Authentication

The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the uuid and code parameters of the social-login callback handler registered on the init hook. The vulnerability exists because the login function's social-login flow...

CVE-2026-104763: Improper Limitation of a Pathname to a Restricted Directory

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'filepath' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...