Browse CVEs

CRITICAL 9.8 CVE-2026-49105 Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.8 CVE-2026-49104 Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 ve… Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.8 CVE-2026-49085 Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-49067 Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-48886 Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.1 CVE-2026-48881 Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 10.0 CVE-2026-48836 Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-45439 Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-42665 Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-42639 Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-42386 Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-42381 Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-40798 Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 10.0 CVE-2026-40772 Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-40771 Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.9 CVE-2026-39591 Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.8 CVE-2026-39583 Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-39530 Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-39519 Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-39512 Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-39511 Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-39502 Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-39493 Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-39492 Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.1 CVE-2026-39465 Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.3 CVE-2026-39441 Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.8 CVE-2026-34901 Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.8 CVE-2026-27053 Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions. Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.8 CVE-2026-50890 Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings. This vul… Mitigation only Fix from $2,3002026-06-15 CRITICAL 9.1 CVE-2026-50887 A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resourc… Mitigation only Fix from $2,3002026-06-15