CVE-2026-108710 - NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated user

CVE-2026-108584 - A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unkn

CVE-2026-108578 - A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the

CVE-2026-108577 - A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects

CVE-2026-108576 - A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function proces

CVE-2026-108575 - A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret

CVE-2026-108574 - A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_vie

CVE-2026-108573 - A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulne

CVE-2026-108572 - A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function

CVE-2026-108571 - A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcm

CVE-2026-108570 - A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the functi

CVE-2026-108569 - A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the

CVE-2026-108568 - A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the functi

CVE-2026-108567 - A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_f

CVE-2026-108566 - A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function in

CVE-2026-108544 - A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This a

CVE-2026-108543 - A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.

CVE-2026-108542 - A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unkn

CVE-2026-97183 - The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its

CVE-2026-96227 - The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submissio

CVE-2026-94235 - The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one o

CVE-2026-93550 - The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remot

CVE-2026-91829 - The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter befor

CVE-2026-89305 - The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before

CVE-2026-89304 - The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before

CVE-2026-89302 - The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a paramete

CVE-2026-89299 - The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter b

CVE-2026-89297 - The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter

CVE-2026-89287 - The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter b

CVE-2026-89285 - The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request paramete

CVE-2026-89283 - The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or

CVE-2026-89234 - The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using

CVE-2026-89232 - The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before usi

CVE-2026-89214 - The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values be

CVE-2026-89213 - The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter befo

CVE-2026-89195 - The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a paramet

CVE-2026-88930 - The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set b

CVE-2026-88905 - The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check wh

CVE-2026-88903 - The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handler

CVE-2026-88827 - The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on a

CVE-2026-88826 - The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJA

CVE-2026-88785 - The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered m

CVE-2026-87764 - The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat me

CVE-2026-87762 - The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks

CVE-2026-87761 - The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or

CVE-2026-87760 - The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measu

CVE-2026-86798 - The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of it

CVE-2026-86717 - The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of it

CVE-2026-86706 - The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on o

CVE-2026-85126 - The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX a

CVE-2026-85121 - The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of it

CVE-2026-85118 - The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capabi

CVE-2026-84737 - The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when a

CVE-2026-84734 - The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied

CVE-2026-84261 - The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape

CVE-2026-84260 - The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape c

CVE-2026-84259 - The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content

CVE-2026-84258 - The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape con

CVE-2026-84254 - The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation a

CVE-2026-84253 - The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation an

CVE-2026-84252 - The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF

CVE-2026-84251 - The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and

CVE-2026-81649 - The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on sev

CVE-2026-81420 - The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it

CVE-2026-81156 - The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery set

CVE-2026-81155 - The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting befor

CVE-2026-81154 - The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before o

CVE-2026-81153 - The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image setti

CVE-2026-14854 - The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before

CVE-2026-12980 - The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substitut

CVE-2026-108541 - A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown fu

CVE-2026-108540 - A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the fi

CVE-2026-107694 - The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 do

CVE-2026-107507 - The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport

CVE-2026-106029 - The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity

CVE-2026-104684 - The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read

CVE-2026-104682 - The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gal

CVE-2026-104681 - The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to

CVE-2026-104680 - The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability

CVE-2026-104028 - The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce ver

CVE-2026-103695 - The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before us

CVE-2026-103694 - The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a

CVE-2026-103305 - The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when sav

CVE-2026-108539 - A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file

CVE-2026-108538 - A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the functi

CVE-2026-108523 - A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unkn

CVE-2026-108522 - A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the

CVE-2026-108521 - A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the f

CVE-2026-108708 - Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAsp

CVE-2026-108707 - Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect tha

CVE-2026-108706 - eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Stora

CVE-2026-108705 - CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data

CVE-2026-108704 - CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged au

CVE-2026-108703 - CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/pu

CVE-2026-108702 - 1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/w

CVE-2026-108701 - 1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractCont

CVE-2026-108700 - 1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authent

CVE-2026-108696 - CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that al

CVE-2026-108695 - MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that

CVE-2026-108694 - ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated user

CVE-2026-108693 - ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerabi

CVE-2026-108692 - 1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight

CVE-2026-108691 - mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storef

CVE-2026-108690 - mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated custom

CVE-2026-108689 - Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticat

CVE-2026-108688 - Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController upl

CVE-2026-104841 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-108680 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated

CVE-2026-108679 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement ha

CVE-2026-108678 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler

CVE-2026-108677 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName

CVE-2026-108676 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementControl

CVE-2026-108675 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementControl

CVE-2026-108674 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController quer

CVE-2026-108673 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController

CVE-2026-108672 - JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handle

CVE-2026-108671 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated

CVE-2026-108670 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handl

CVE-2026-108669 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handle

CVE-2026-108668 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController

CVE-2026-108667 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108666 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of

CVE-2026-108665 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController

CVE-2026-108664 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController

CVE-2026-108663 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController de

CVE-2026-108662 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108661 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated

CVE-2026-108660 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated

CVE-2026-108659 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController li

CVE-2026-108658 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController qu

CVE-2026-108657 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController pa

CVE-2026-108656 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GE

CVE-2026-108655 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController qu

CVE-2026-108654 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController quer

CVE-2026-108653 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler

CVE-2026-108652 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController up

CVE-2026-108651 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handl

CVE-2026-108650 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet h

CVE-2026-108649 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById han

CVE-2026-108648 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynami

CVE-2026-108647 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108646 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController

CVE-2026-108645 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that

CVE-2026-108644 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController

CVE-2026-108643 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108642 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendControl

CVE-2026-108641 - JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authe

CVE-2026-108640 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleControlle

CVE-2026-108639 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated

CVE-2026-108638 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108637 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108636 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController ap

CVE-2026-108635 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/get

CVE-2026-108634 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108633 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108632 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionCon

CVE-2026-108631 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionCon

CVE-2026-108630 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionControl

CVE-2026-108629 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler o

CVE-2026-108628 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission

CVE-2026-108627 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler o

CVE-2026-108626 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController q

CVE-2026-108625 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108624 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController d

CVE-2026-108623 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delet

CVE-2026-108622 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delet

CVE-2026-108621 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController

CVE-2026-108620 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController

CVE-2026-108619 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108618 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108617 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108616 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController

CVE-2026-108615 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController

CVE-2026-108614 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController

CVE-2026-108613 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController rel

CVE-2026-108612 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateContro

CVE-2026-108611 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateContro

CVE-2026-108610 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateContro

CVE-2026-108609 - JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authe

CVE-2026-108608 - JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authe

CVE-2026-108607 - JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authe

CVE-2026-108606 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController delete

CVE-2026-108605 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController update

CVE-2026-97853 - Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service

CVE-2026-81797 - Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2

CVE-2026-78535 - Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

CVE-2026-78534 - Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.

CVE-2026-78533 - Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

CVE-2026-78532 - Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.

CVE-2026-78531 - Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

CVE-2026-78530 - Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.

CVE-2026-78529 - Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

CVE-2026-66569 - Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

CVE-2026-66568 - Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

CVE-2026-66567 - Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

CVE-2026-66566 - Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

CVE-2026-66565 - Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

CVE-2026-66564 - Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

CVE-2026-66563 - Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

CVE-2026-66483 - Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

CVE-2026-66482 - Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

CVE-2026-66481 - Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.

CVE-2026-66480 - Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YIT

CVE-2026-65459 - Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

CVE-2026-62130 - Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

CVE-2026-62129 - Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

CVE-2026-62125 - Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

CVE-2026-62124 - Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

CVE-2026-62123 - Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

CVE-2026-62120 - Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

CVE-2026-62118 - Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 ve

CVE-2026-62117 - Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

CVE-2026-62116 - Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13

CVE-2026-62115 - Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.

CVE-2026-62100 - Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.

CVE-2026-62099 - Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.

CVE-2026-62098 - Unauthenticated Content Injection in Boutique <= 2.3.3 versions.

CVE-2026-62096 - Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.

CVE-2026-62095 - Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.

CVE-2026-62094 - Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.

CVE-2026-62093 - Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.

CVE-2026-62092 - Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.

CVE-2026-62091 - Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.

CVE-2026-62090 - Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

CVE-2026-62087 - Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

CVE-2026-62086 - Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

CVE-2026-62082 - Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.

CVE-2026-62077 - Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

CVE-2026-62076 - Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

CVE-2026-62075 - Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.

CVE-2026-62074 - Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

CVE-2026-62070 - Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.

CVE-2026-62069 - Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.

CVE-2026-62068 - Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.

CVE-2026-62067 - Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.

CVE-2026-62066 - Unauthenticated Local File Inclusion in Volos <= 1.2 versions.

CVE-2026-62065 - Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.

CVE-2026-62064 - Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.

CVE-2026-62054 - Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

CVE-2026-62053 - Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

CVE-2026-62052 - Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

CVE-2026-62051 - Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

CVE-2026-62050 - Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

CVE-2026-62043 - Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions

CVE-2026-62038 - Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

CVE-2026-62037 - Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

CVE-2026-62035 - Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.

CVE-2026-62034 - Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for W

CVE-2026-62033 - Subscriber Settings Change in uListing <= 2.2.0 versions.

CVE-2026-62032 - Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.