2026

The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin

The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting t

Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan);

sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values f

Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.

Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.

Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.

Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.

Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.

Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.

Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.

Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affe

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.

Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.

Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.

Subscriber SQL Injection in Cornerstone < 7.8.8 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.

RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary c

Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.

Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation &amp; Chat Widget <= 4.2

Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.

A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or

Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.

Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.

Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.

Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.

Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.

Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngi

Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist

Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.

Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.

Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.

Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.

Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.

Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthent

Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.

Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, th

Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Version

Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accept