Critical vulnerability archive — page 23

floci-io1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2026-108598 · floci-io floci

Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

EPSS 0.9%public exploit CVSS 9.8

WuKongOpenSource1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-108707 · WuKongOpenSource Wukong_HRM

Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect

EPSS 0.6%public exploit CVSS 9.8

Unknown3 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-104028 · Unknown Anton Extensions

Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE

EPSS 0.6%CVSS 9.8

CVE-2026-81649 · Unknown Fundiin cho WooCommerce

Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure

EPSS 0.3%CVSS 9.1

CVE-2026-84251 · Unknown click5 CRM add-on to Ninja Forms

click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update

EPSS 0.2%CVSS 9.8

Sarah Giles1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-42719 · Sarah Giles Dynamic User Directory

WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability

EPSS 0.5%CVSS 9.8

CodeBard1 vulnerability on this pageMax CVSS 9.9Priority 37KEV 0

CVE-2026-62024 · CodeBard CodeBard Help Desk

WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability

EPSS 0.4%CVSS 9.9

ferdikoomen1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-108551 · ferdikoomen openapi-typescript-codegen

openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates

EPSS 0.4%CVSS 9.8

rtCamp Inc.1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-105892 · rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability

EPSS 0.4%CVSS 9.8

Sergey1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-39801 · Sergey AIWU

WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability

EPSS 0.4%CVSS 9.8

AncoraThemes4 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-42723 · AncoraThemes CleanSkin

WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

CVE-2026-78533 · AncoraThemes Qwery

WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-66482 · AncoraThemes Drone Media

WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-66567 · AncoraThemes Anesta

WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

BoldThemes1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-62077 · BoldThemes Avala

WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

miniOrange1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-106610 · miniOrange miniorange otp verification

WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability

EPSS 0.4%CVSS 9.8

payever1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-42716 · payever Payever - WooCommerce Gateway

WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

Pluggabl1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-42718 · Pluggabl Booster for WooCommerce

WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

Royal Plugins1 vulnerability on this pageMax CVSS 10.0Priority 36KEV 0

CVE-2026-42696 · Royal Plugins SiteVault – Backup, Restore, Migration & Cloning

WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability

EPSS 0.4%CVSS 10.0

The41 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-62076 · The4 Kalles

WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

ThemeRex19 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-62050 · ThemeREX Splendour

WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

CVE-2026-62051 · ThemeREX Stargaze

WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

CVE-2026-62052 · ThemeREX Tipsy

WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

CVE-2026-62053 · ThemeREX Wine House

WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

CVE-2026-62054 · ThemeREX Yacht Rental

WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

CVE-2026-62086 · ThemeREX Juno

WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

CVE-2026-62087 · ThemeREX Equadio

WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

CVE-2026-62090 · ThemeREX WineShop

WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

CVE-2026-78535 · ThemeRex Photolia

WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-62120 · ThemeREX Law Office

WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-62123 · ThemeREX Invetex

WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-62124 · ThemeREX N7 | Golf Club Sports & Events

WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-62125 · ThemeREX Asia Garden

WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-66483 · ThemeREX Education Center

WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-66563 · ThemeREX Windsor

WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-66564 · ThemeREX ShiftCV

WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-78529 · ThemeREX Alliance

WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-78531 · ThemeREX Jacqueline

WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-81797 · ThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme

WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

Designinvento1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-62032 · Designinvento DirectoryPress

WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability

EPSS 0.3%CVSS 9.8

VillaTheme1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-104398 · VillaTheme AFFI – Affiliate Marketing for WooCommerce

WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

axiomthemes3 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-66565 · axiomthemes FC United

WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-66568 · axiomthemes Original

WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

CVE-2026-66569 · axiomthemes Kicker

WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability

EPSS 0.3%CVSS 9.8

ELEXtensions1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2026-40800 · ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes

WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

Select-Themes1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-62022 · Select-Themes Tonda Membership

WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability

EPSS 0.3%CVSS 9.8

WPFunnels1 vulnerability on this pageMax CVSS 9.9Priority 33KEV 0

CVE-2026-62129 · WPFunnels Creator LMS

WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability

EPSS 0.3%CVSS 9.9

Stylemix1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2026-62031 · Stylemix uListing

WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

EPSS 0.3%CVSS 9.3

Tailored Media1 vulnerability on this pageMax CVSS 9.0Priority 31KEV 0

CVE-2026-62025 · Tailored Media Tailored Tools

WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability

EPSS 0.3%CVSS 9.0

Tickera1 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2026-105889 · Tickera Tickera

WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability

EPSS 0.2%CVSS 9.3

The archive.