CVE-2026-106608: Incorrect Privilege Assignment

Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2...

CVE-2026-62032: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in DirectoryPress = 3.6.27 versions...

CVE-2026-62124: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events = 2.21 versions...

CVE-2026-62123: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Invetex = 2.18 versions...

CVE-2026-62020: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in TouchUp 1.4 versions...

CVE-2026-42722: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...

CVE-2026-103636: Out-of-bounds Read

Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ repo: datasketches-cpp. varoptunion::deserialize read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes...

CVE-2026-103998: Improper Neutralization of Input During Web Page Generation

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs array key' parameter in all versions up to, and including, 1.15.48 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-103071: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3...

CVE-2026-101947: Improper Neutralization of Special Elements used in an OS Command

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

CVE-2026-96558: Improper Neutralization of Input During Web Page Generation

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsmhiddenquestions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-96341: Incorrect Privilege Assignment

Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3...

CVE-2026-93927: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0...

CVE-2026-91050: Authorization Bypass Through User-Controlled Key

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable stepsstart and stepsloadstep routes...

CVE-2026-66483: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Education Center = 3.6.12 versions...

CVE-2026-66563: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Windsor = 2.10 versions...

CVE-2026-78529: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Alliance = 3.11 versions...

CVE-2026-78532: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in LMS = 8.3 versions...

CVE-2026-93944: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15...

CVE-2026-78530: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Deletion in FoodBakery = 4.6 versions...

CVE-2026-14877: Improper Neutralization of Input During Web Page Generation

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-104841: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-104993: Improper Neutralization of Input During Web Page Generation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email Contact Email custom field htmlvarname' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization...

CVE-2026-104759: Improper Authentication

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to IdTokenServiceDeprecated::processopenidconnecttoken using the incompatible WordPress...

CVE-2026-96278: Improper Neutralization of Input During Web Page Generation

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-94676: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0...

CVE-2026-62064: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ambed = 1.0.0 versions...

CVE-2026-62037: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...

CVE-2026-103482: Improper Neutralization of Input During Web Page Generation

The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptinfields e.g. firstname' parameter in all versions up to, and including, 4.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-108627: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

CVE-2026-96662: Improper Neutralization of Special Elements used in an SQL Command

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-89100: Improper Neutralization of Input During Web Page Generation

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-93942: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0...

CVE-2026-93936: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4...

CVE-2026-93929: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16...

CVE-2026-94160: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4...

CVE-2026-62098: Improper Control of Generation of Code

Unauthenticated Content Injection in Boutique = 2.3.3 versions...

CVE-2026-62096: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Biolife = 3.2.3 versions...

CVE-2026-62094: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in TechOne = 3.0.3 versions...

CVE-2026-62090: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WineShop = 3.20 versions...

CVE-2026-62087: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Equadio = 1.1.4 versions...

CVE-2026-62074: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Ozeum = 1.3.0 versions...

CVE-2026-62070: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Flipmart = 2.8 versions...

CVE-2026-66565: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in FC United = 1.1.1 versions...

CVE-2026-66482: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Drone Media = 2.2.0 versions...

CVE-2026-66481: Improper Limitation of a Pathname to a Restricted Directory

Author Arbitrary File Deletion in Presto Player Pro = 3.0.1 versions...

CVE-2026-66569: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Kicker = 2.2.1 versions...

CVE-2026-96563: Improper Neutralization of Input During Web Page Generation

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stmfs' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-89301: Missing Authorization

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe...

CVE-2026-97630: Improper Neutralization of Input During Web Page Generation

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...