Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-115806 | 9.8 critical | 1.0% | no CPE yet | The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself. | Mon 26 Oct |
| CVE-2026-27429 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions. | Mon 26 Oct |
| CVE-2026-49781 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions. | Sun 25 Oct |
| CVE-2026-57621 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions. | Sun 25 Oct |
| CVE-2026-57677 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions. | Sun 25 Oct |
| CVE-2026-56032 | 9.8 critical | 1.0% | no CPE yet | Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions. | Sun 25 Oct |
| CVE-2026-56057 | 9.8 critical | 1.0% | no CPE yet | Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions. | Sun 25 Oct |
| CVE-2026-12116 | 9.8 critical | 1.0% | no CPE yet | A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed. | Sun 25 Oct |
| CVE-2026-32563 | 9.8 critical | 1.0% | no CPE yet | Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. | 24 Oct |
| CVE-2026-15982 | 9.8 critical | 1.0% | no CPE yet | The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts. | 24 Oct |
| CVE-2026-49827 | 9.8 critical | 1.0% | no CPE yet | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818. | 24 Oct |
| CVE-2026-65552 | 9.8 critical | 1.0% | no CPE yet | Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. | 24 Oct |
| CVE-2026-65556 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions. | 24 Oct |
| CVE-2026-65571 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions. | 24 Oct |
| CVE-2026-65572 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. | 24 Oct |
| CVE-2026-65573 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Abelle <= 1.22 versions. | 24 Oct |
| CVE-2026-65574 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Abogado <= 1.18 versions. | 24 Oct |
| CVE-2026-65575 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions. | 24 Oct |
| CVE-2026-65576 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions. | 24 Oct |
| CVE-2026-65577 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions. | 24 Oct |
| CVE-2026-65578 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Agora <= 1.9 versions. | 24 Oct |
| CVE-2026-65579 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions. | 24 Oct |
| CVE-2026-65581 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions. | 24 Oct |
| CVE-2026-72592 | 9.8 critical | 1.0% | no CPE yet | An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ( = array) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path. | 24 Oct |
| CVE-2026-71207 | 9.8 critical | 1.0% | no CPE yet | The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path. | 24 Oct |
| CVE-2026-71231 | 9.8 critical | 1.0% | no CPE yet | IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string. | 24 Oct |
| CVE-2023-25207 | 9.8 critical | 1.0% | prestashop, dpd_france | PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php. | 24 Oct |
| CVE-2026-42380 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions. | 24 Oct |
| CVE-2026-64796 | 9.8 critical | 1.0% | no CPE yet | Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection. | 24 Oct |
| CVE-2026-59544 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions. | 24 Oct |
| CVE-2026-73376 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. | 23 Oct |
| CVE-2026-28139 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions. | 23 Oct |
| CVE-2026-28149 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. | 23 Oct |
| CVE-2026-67960 | 9.8 critical | 1.0% | no CPE yet | An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components | 22 Oct |
| CVE-2026-32470 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. | 22 Oct |
| CVE-2026-73341 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions. | 22 Oct |
| CVE-2026-73366 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions. | 22 Oct |
| CVE-2026-73380 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions. | 22 Oct |
| CVE-2026-111862 | 9.8 critical | 1.0% | no CPE yet | Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement. | 20 Oct |
| CVE-2026-89990 | 9.8 critical | 1.0% | no CPE yet | In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in ceph_mds_check_access() MDS session OPEN handling replaces mdsc->s_cap_auths under mdsc->mutex, freeing the previous array and its strings. ceph_mds_check_access() traverses this array without holding the mutex. A concurrent session reopen can therefore free the array while it is being inspected, resulting in a use-after-free like this: Unable to handle kernel paging request at virtual address 003aaad64b2c8bb9 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 56 UID: 2953037534 PID: 1253231 Comm: php-cgi8.4 Not tainted 6.18.45-i2-ampere #1146 NONE [..] pc : ceph_mds_check_access+0xd4/0x550 lr : ceph_mds_check_access+0xc8/0x550 [...] Call trace: ceph_mds_check_access+0xd4/0x550 (P) ceph_atomic_open+0x138/0xbe8 path_openat+0xa24/0xfa8 do_filp_open+0x94/0x158 do_sys_openat2+0x88/0xf8 | 19 Oct |
| CVE-2025-12493 | 9.8 critical | 1.0% | hasthemes, shoplentor | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. | 18 Oct |
| CVE-2025-41734 | 9.8 critical | 1.0% | metz-connect, ewio2-m_firmware, ewio2-m-bm_firmware, ewio2-bm_firmware | An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices. | 18 Oct |
| CVE-2026-55573 | 9.8 critical | 1.0% | no CPE yet | e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7. | 16 Oct |
| CVE-2026-104730 | 9.8 critical | 1.0% | no CPE yet | The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery. | 16 Oct |
| CVE-2026-110002 | 9.8 critical | 1.0% | no CPE yet | The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to-cache.php script is directly reachable without loading WordPress; FILTER_SANITIZE_URL — the only filter applied to the pluginURL value — preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request. | 15 Oct |
| CVE-2026-104800 | 9.8 critical | 1.0% | no CPE yet | The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API. | 15 Oct |
| CVE-2026-55683 | 9.8 critical | 1.0% | no CPE yet | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6. | 15 Oct |
| CVE-2025-65474 | 9.8 critical | 1.0% | easyimages2.0_project, easyimages2.0 | An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format. | 14 Oct |
| CVE-2026-93388 | 9.8 critical | 1.0% | no CPE yet | The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. | 14 Oct |
| CVE-2026-104028 | 9.8 critical | 1.0% | no CPE yet | The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution. | 13 Oct |
Download these 368 as CSV · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.