Tagged “cve.org”
CVEs tagged cve.org, newest first.
47129 CVEsRSS
CVE-2026-61997Critical· 9.8WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
CVE-2026-61992Critical· 9.8WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
CVE-2026-61998Critical· 9.8WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
CVE-2026-62003Critical· 9.8WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
CVE-2026-61989High· 7.1PoCWordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.
CVE-2026-62005Critical· 9.8WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
CVE-2026-62004Critical· 9.8WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
CVE-2026-62131Critical· 9.8WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.
CVE-2026-62010Critical· 9.8WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
CVE-2026-62009Critical· 9.8WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
CVE-2026-62016Critical· 9.8WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
CVE-2026-62015Critical· 9.8WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
CVE-2026-62014Critical· 9.8WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
CVE-2026-62011Critical· 9.8WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
CVE-2026-116866High· 8.8WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
CVE-2026-116864High· 7.2WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
CVE-2026-118074High· 7.2WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
CVE-2026-116865High· 7.2WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability
Editor PHP Object Injection in Zippy <= 1.7.0 versions.
CVE-2026-116869High· 7.2WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
CVE-2026-118077High· 7.2WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
CVE-2026-118078High· 7.2WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
CVE-2026-118073High· 8.8WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
CVE-2026-118082High· 8.8WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.
CVE-2026-118083High· 7.5WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.
CVE-2026-54865Medium· 6.5WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.
CVE-2026-61996High· 8.5WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability
Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.
CVE-2026-116848Medium· 6.5WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This …
CVE-2026-118084Medium· 6.5WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
CVE-2026-115610Medium· 6.5WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.
CVE-2026-107023Medium· 6.5PoCInsecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content.
Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content.