2026

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

Subscriber Broken Access Control in FormGent <= 1.12.2 versions.

Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiP

Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 v

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.

Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.

Author SQL Injection in Quiz Cat <= 3.1.1 versions.

Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.

Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside

Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Cont

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cry

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's

A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main head

The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-a

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concu

Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access t

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including,

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload an

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, w

Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attack

A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnor

A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause ab

An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal p

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Inje

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and i

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded th

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attack

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits in

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the