2026

Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.

Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.

Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.

Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.

Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.

Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.

Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell t

Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.

Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.

Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.

Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.

Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.

Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.

Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.

Unauthenticated Local File Inclusion in Getaway < 1.8 versions.

Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.

Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.

Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.

Unauthenticated Local File Inclusion in Solene <= 3.4 versions.

Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.

Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions.

Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions.

Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.

Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions.

Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions.

In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead

Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.

Unauthenticated Broken Authentication in Booknetic <= 4.8.5 versions.

Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions.

Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions.

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.

Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.

Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions.

Unauthenticated Local File Inclusion in Right Way <= 4.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions.

Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.

Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions.

Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the render