#wordpress
23 articles
CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the act...
CVE-2026-32475: Unrestricted file upload leading to RCE in Elementor Pro
Elementor Pro through 4.2.1 allows unrestricted upload of dangerous file types. Patchstack describes a path from unauthenticated upload to RCE...
CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-202...
CVE-2026-6960: Arbitrary file upload in WordPress BookingPress Pro plugin
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all version...
CVE-2026-6279: Unauthenticated RCE in WordPress Avada Builder plugin
The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp...
CVE-2026-45444: Arbitrary file upload in Gift Cards For WooCommerce Pro (plugin)
Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a thr...
CVE-2026-6555: Arbitrary File Upload in WordPress ProSolution WP Client (plugin)
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in ...
CVE-2026-7637: PHP Object Injection in WordPress Boost (plugin)
The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOCATION cookie. This make...
CVE-2026-4883: Arbitrary File Upload in WordPress Piotnet Forms plugin
The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetforms_ajax_form_builder' function in all versions up to, and including,...
CVE-2026-4885: Arbitrary File Upload in WordPress Piotnet Addons for Elementor Pro
The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and...
CVE-2026-5229: Authentication Bypass in WordPress Form Notify plugin
The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.1.10. This is due to the plugin trusting user-controlled cookie data to determine which Wo...
CVE-2026-6510: Privilege Escalation in WordPress InfusedWoo Pro plugin
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capab...
CVE-2026-8181: Authentication bypass in WordPress Burst Statistics (plugin)
Authentication bypass in Burst Statistics WordPress plugin versions 3.4.0 to 3.4.1.1 due to incorrect return-value handling in is_mainwp_authenticated(). Unauthenticated attackers with knowledge of admin username can impersonate that administrator...
CVE-2026-4882: Arbitrary file upload in WordPress User Registration Advanced Fields
The User Registration Advanced Fields plugin for WordPress (versions up to and including 1.6.20) allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution on the server...
CVE-2026-7458: Authentication bypass in WordPress User Verification by PickPlugins
The User Verification by PickPlugins plugin for WordPress (versions up to and including 2.0.46) allows unauthenticated attackers to log in as any user with a verified email by submitting an OTP value of "true"...
CVE-2026-7567: Authentication bypass in WordPress Temporary Login plugin
The Temporary Login plugin for WordPress (versions up to and including 1.0.0) contains an authentication bypass in the maybe_login_temporary_user() function. Passing an array instead of a string in the GET parameter lets an attacker log in as an arbitrary user, typically an administrator...
CVE-2026-1555: Arbitrary file upload in WebStack theme for WordPress
The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function, which may enable remote code execution...
CVE-2026-34424: Backdoored Smart Slider 3 Pro plugin for WordPress
Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that allows unauthenticated attackers to execute ...
CVE-2026-3535: Arbitrary file upload in WordPress
The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function in all versions up to, a...
CVE-2026-0740: Arbitrary file upload in Ninja Forms File Uploads plugin for WordPress
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all v...
CVE-2026-3300: PHP code injection RCE in Everest Forms Pro plugin for WordPress
The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_fi...
CVE-2026-4257: Remote code execution in WordPress
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is d...
CVE-2026-4001: Critical Vulnerability in WordPress Woocommerce Custom Product Addons Pro - Immediate Update Required
The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_c...