A critical object injection vulnerability in the Greeny WordPress theme affects versions through 2.10.0, posing severe risks to unpatched sites.
A CVSS 9.8 deserialization flaw in Hogwords versions up to 1.2.7 allows object injection, exposing sites to severe remote compromise risks.
A critical deserialization flaw in ThemeREX Group’s Convex plugin allows object injection, affecting all versions up to 1.16.0 with a CVSS score of 9.8.
The National Vulnerability Database rates CVE-2026-62046 as critical, affecting all Gutentype plugin versions up to 2.1.12 with untrusted data deserialization risks.
An unauthenticated object injection vulnerability in the Booklovers WordPress theme allows remote attackers to exploit deserialization flaws in versions up to 2.13.0.
A critical vulnerability in PHPNuxBill allows attackers to bypass password reset protections and hijack customer accounts without authentication.
Unauthenticated attackers can trigger arbitrary WordPress hooks via Avada Builder forms, risking permanent content deletion and site disruption through CVE-2026-97670.
Unpatched TinaCMS versions allow attackers to hijack editor sessions via crafted preview links, granting full API access until updates are deployed.
A critical flaw in the PPOM plugin for WordPress lets attackers delete server files and execute code without logging in, affecting versions up to 34.0.10.
A critical deserialization vulnerability in ThemeREX Tantra CMS versions up to 2.9.0 allows object injection, posing severe risks to business operations.
A critical vulnerability in Smart Casa allows object injection, posing severe risks to small businesses using versions up to 1.0.12.
Unauthenticated visitors can inject scripts via comment metadata that execute in the backend session of any administrator viewing the moderation list.
Unauthenticated users can exploit a flaw in Enswitch versions 3.13 through 4.4 to change passwords and seize administrator access by omitting reset parameters.
Cisco Talos researcher Pierre launches a new series on managing risk when perfect patches are unavailable, focusing on keeping vital systems running.
CERT-EU warns that a severe vulnerability in eight Atlassian products is being exploited, urging immediate upgrades for internet-facing installations.
An unauthenticated server-side request forgery in Cisco Finesse management UI enables attackers to access limited sensitive service information.
CISA adds two critical NetScaler vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, urging immediate mitigation to prevent remote code execution or denial of service.