Threat database

CVE-2026-62022 is a critical vulnerability in Select-Themes Tonda Membership version 1.0.1 and earlier that allows unauthenticated users to escalate privileges due to incorrect privilege assignment. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62021 is a high severity vulnerability in rascals Angio versions up to and including 1.1.1. It involves PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62020 is a high-severity vulnerability in Mikado-Themes TouchUp versions prior to 1.4. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements, classified under CWE-98. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-48194 is a high-severity vulnerability in kutethemes DukaMarket versions up to 1.3.0. It involves an unauthenticated Local File Inclusion (LFI) due to improper control of filenames in include/require statements in PHP. This flaw allows an attacker to include local files on the server, potentially leading to remote code execution or full system compromise.

CVE-2026-48193 is a high severity vulnerability in kutethemes Uminex versions up to and including 1.0.9. It is an unauthenticated Local File Inclusion (LFI) vulnerability caused by improper control of filenames used in include or require statements in PHP. This flaw could allow an attacker to include and execute arbitrary local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-45440 is a high severity SQL Injection vulnerability affecting WP Ultimate CSV Importer versions up to 9.2. It allows an authenticated administrator to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to data confidentiality breaches and partial denial of service. No specific affected versions beyond "<= 9.2" are provided, and no patch or remediation details are available in the input data.

CVE-2026-42777 is a high-severity vulnerability in Edge-Themes Aalto versions 1.8 and earlier that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw can lead to remote file inclusion attacks, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-42724 is a high-severity vulnerability in AncoraThemes CleanSkin versions up to and including 1.5.0. It involves an unauthenticated Local File Inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP code. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-42723 is a critical vulnerability in AncoraThemes CleanSkin version 1.5.0 and earlier. It involves unauthenticated PHP object injection due to deserialization of untrusted data, classified as CWE-502. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-42722 is a high-severity SQL Injection vulnerability affecting Frontend Admin by DynamiApps versions up to and including 3.29.13. The flaw allows an administrator-level user to inject SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to high confidentiality impact and limited availability impact but does not affect integrity. No public exploits are known, and no patch information is currently available.

CVE-2026-42719 is a critical vulnerability in Sarah Giles Dynamic User Directory versions 2.4 and earlier. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability without requiring user interaction.

CVE-2026-42718 is a critical vulnerability in Booster for WooCommerce, a plugin by Pluggabl. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data in versions up to and including 8.4.0. This flaw allows remote attackers to execute arbitrary code without authentication.

CVE-2026-42717 is a high-severity SQL Injection vulnerability affecting VaultDweller's Leyka product versions up to and including 3.32.3. The flaw allows an administrator-level user to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability has a CVSS score of 7.6, indicating a significant risk primarily to confidentiality and availability. No official patch or remediation details are provided, and no known exploits are reported in the wild.

CVE-2026-42716 is a critical vulnerability in the Payever - WooCommerce Gateway plugin, affecting versions up to and including 4.8.2. It involves unauthenticated PHP object injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability. The vulnerability has a high CVSS score of 9.8, indicating severe impact if exploited.

CVE-2026-42715 is a high-severity cross-site scripting (XSS) vulnerability affecting Photo Gallery by 10Web versions 1.8.47 and earlier. It allows unauthenticated attackers to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. The vulnerability requires user interaction to exploit and has a low attack complexity. No specific patch or remediation details are provided in the available data.

CVE-2026-42712 is a high severity SQL Injection vulnerability affecting Qode Tours versions up to and including 3.1.3.2. The flaw involves improper neutralization of special elements in SQL commands, specifically in the subscriber functionality. This vulnerability could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to data confidentiality breaches and partial service disruption.

CVE-2026-42711 is a high-severity cross-site scripting (XSS) vulnerability in Slider by 10Web versions up to and including 1.2.63. The flaw allows unauthenticated attackers to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability.

CVE-2026-42709 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in the RadiusTheme Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin, affecting versions up to 6.0.5. This vulnerability allows attackers to inject malicious scripts during web page generation without authentication. The flaw is categorized under CWE-79, indicating improper neutralization of input. No specific affected versions or patch information is provided in the available data.

CVE-2026-42706 is a high-severity vulnerability in ThemeGoods DK versions up to 3.2.1, involving missing authorization controls. This unauthenticated broken access control flaw allows unauthorized users to perform actions that should require authorization, potentially leading to integrity impacts. No patch information is provided, and no known exploits are reported in the wild.

CVE-2026-42705 is a high severity vulnerability in ThemeGoods Grand News versions up to 3.4 that involves missing authorization controls. This unauthenticated broken access control flaw allows an attacker to perform unauthorized actions that impact the integrity of the application. No patch information is currently provided, and no known exploits are reported in the wild.