Vulnerabilities
Critical Deserialization Flaw in ThemeREX Greeny Theme Rated 9.8 CVSS
A critical object injection vulnerability in the Greeny WordPress theme allows remote attackers to execute arbitrary code on affected sites through untrusted data.
WordPress
Vulnerabilities
Critical Deserialization Flaw Found in ThemeREX Camelia Plugin Through Version 1.2.15
The National Vulnerability Database rates CVE-2026-93944 as critical, citing object injection risks in the popular WordPress theme framework.
Vulnerabilities
Critical CVE-2026-62046 Object Injection Flaw Found in ThemeREX Gutentype Plugin
A CVSS 9.8 critical vulnerability in ThemeREX Group Gutentype allows object injection via untrusted data deserialization in versions up to 2.1.12.
Vulnerabilities
Critical Object Injection Flaw Found in Booklovers WordPress Theme
The National Vulnerability Database rates CVE-2026-62045 as critical due to untrusted data deserialization risks in the Booklovers theme.
Vulnerabilities
Critical WordPress Plugin Flaw Allows Unauthenticated File Deletion and Remote Code Execution
A critical vulnerability in the PPOM WooCommerce plugin lets attackers delete server files, potentially enabling remote code execution in versions up to 34.0.10.
Vulnerabilities
Avada Builder Plugin Vulnerable to Critical Auth Bypass in Versions Up to 7.16.1
Unauthenticated attackers can trigger arbitrary WordPress action hooks via the Avada Builder plugin, risking permanent site content deletion and denial of service.
Vulnerabilities
Critical RCE Vulnerability Found in 3D Product Configurator for WooCommerce Plugin
Unauthenticated attackers can execute arbitrary code on WordPress sites using the vulnerable 3D Product Configurator plugin due to missing security checks.
Vulnerabilities
Critical Privilege Escalation Flaw Found in Blocksy Companion WordPress Plugin
Unauthenticated attackers can exploit CVE-2026-107645 to escalate privileges to seller accounts in vulnerable Blocksy Companion versions.
Vulnerabilities
Critical Auth Bypass in WordPress Advanced IP Blocker Plugin Allows Unauthenticated Access
A flaw in the Advanced IP Blocker plugin lets attackers bypass passwords and 2FA to take over WordPress sites using known user IDs.
Vulnerabilities
Critical WordPress Plugin Flaw Allows Unauthenticated Remote Code Execution
A critical vulnerability in the Extensions For CF7 WordPress plugin enables unauthenticated attackers to execute remote code via arbitrary file upload.
Vulnerabilities
Critical SQL Injection Flaw Found in VibeThemes WPLMS WordPress Plugin
A critical blind SQL injection vulnerability in the WPLMS plugin affects versions prior to 1.9.9.8.2, posing significant risks to site administrators.
Vulnerabilities
Critical SQL Injection Flaw Found in JNews Pay Writer Plugin
A severe vulnerability in the JNews Pay Writer WordPress plugin allows blind SQL injection, affecting versions up to 12.0.1.
Vulnerabilities
Critical SQL Injection Flaw Found in Ajax Search Pro WordPress Plugin
A high-severity vulnerability in the popular Ajax Search Pro plugin allows blind SQL injection, affecting versions up to 4.29.1 with no confirmed patch yet.
Vulnerabilities
Critical Blind SQL Injection Flaw Found in Shinetheme Traveler WordPress Plugin
Researchers have identified a critical vulnerability in the Shinetheme Traveler plugin that allows attackers to perform blind SQL injection attacks on affected sites.
Vulnerabilities
WordPress 7.1.3 Addresses Seven Security Flaws in Latest Maintenance Release
The WordPress project has issued version 7.1.3, a maintenance and security update containing seven security fixes and four bug fixes for immediate deployment.