Skip to content
OpenAdvisories

Source

ENISA EU Vulnerability Database

Source: https://euvd.enisa.europa.eu/

All Critical High Medium Low Exploited only Public exploit

25,541 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-81797

    WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

    ThemeREX Buzz Stone | Magazine & Viral Blog WordPress Theme Web / CMS
  • Critical 9.8
    CVE-2026-78535

    WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

    ThemeREX Photolia
  • Critical 9.8
    CVE-2026-78533

    WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

    AncoraThemes Qwery
  • Critical 9.8
    CVE-2026-78531

    WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

    ThemeREX Jacqueline
  • Critical 9.8
    CVE-2026-78529

    WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

    ThemeREX Alliance
  • Critical 9.8
    CVE-2026-66569

    WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

    axiomthemes Kicker
  • Critical 9.8
    CVE-2026-66568

    WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

    axiomthemes Original
  • Critical 9.8
    CVE-2026-66567

    WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

    AncoraThemes Anesta
  • Critical 9.8
    CVE-2026-66565

    WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

    axiomthemes FC United
  • Critical 9.8
    CVE-2026-66564

    WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

    ThemeREX ShiftCV
  • Critical 9.8
    CVE-2026-66563

    WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

    ThemeREX Windsor
  • Critical 9.8
    CVE-2026-66483

    WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

    ThemeREX Education Center
  • Critical 9.8
    CVE-2026-66482

    WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

    AncoraThemes Drone Media
  • Critical 9.9
    CVE-2026-62129

    WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability

    Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

    WPFunnels Creator LMS
  • Critical 9.8
    CVE-2026-62125

    WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

    ThemeREX Asia Garden
  • Critical 9.8
    CVE-2026-62123

    WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

    ThemeREX Invetex
  • Critical 9.8
    CVE-2026-62124

    WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

    ThemeREX N7 | Golf Club Sports & Events
  • Critical 9.8
    CVE-2026-62120

    WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

    ThemeREX Law Office
  • Critical 9.8
    CVE-2026-62090

    WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

    ThemeREX WineShop
  • Critical 9.8
    CVE-2026-62087

    WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

    ThemeREX Equadio
  • Critical 9.8
    CVE-2026-62086

    WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

    ThemeREX Juno
  • Critical 9.8
    CVE-2026-62077

    WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

    Bold Themes Avala
  • Critical 9.8
    CVE-2026-62076

    WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

    The4 Kalles
  • Critical 9.8
    CVE-2026-62054

    WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

    ThemeREX Yacht Rental
  • Critical 9.8
    CVE-2026-62053

    WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

    ThemeREX Wine House
  • Critical 9.8
    CVE-2026-62052

    WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

    ThemeREX Tipsy
  • Critical 9.8
    CVE-2026-62051

    WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

    ThemeREX Stargaze
  • Critical 9.8
    CVE-2026-62050

    WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

    ThemeREX Splendour
  • Critical 9.3
    CVE-2026-62031

    WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes uListing ulisting allows Blind SQL Injection.This issue affects uListing: from n/a through 2.2.0.

    StylemixThemes uListing
  • Critical 9.8
    CVE-2026-62032

    WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Designinvento DirectoryPress directorypress allows PHP Local File Inclusion.This issue affects DirectoryPress: from n/a through 3.6.27.

    Designinvento DirectoryPress
  • Critical 9.9
    CVE-2026-62024

    WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability

    Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.

    CodeBard CodeBard Help Desk
  • Critical 9.0
    CVE-2026-62025

    WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability

    Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.

    Tailored Media Tailored Tools
  • Critical 9.8
    CVE-2026-62022

    WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

    Select-Themes Tonda Membership
  • Critical 9.8
    CVE-2026-42723

    WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

    AncoraThemes CleanSkin
  • Critical 9.8
    CVE-2026-42719

    WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability

    Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

    Sarah Giles Dynamic User Directory
  • Critical 9.8
    CVE-2026-42718

    WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

    Pluggabl Booster for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2026-42716

    WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

    payever Payever - WooCommerce Gateway Web / CMS
  • Critical 10.0
    CVE-2026-42696

    WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration &amp; Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migra…

    Royal Plugins SiteVault – Backup, Restore, Migration &amp; Cloning
  • Critical 9.3
    CVE-2026-40800

    WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability

    Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

    ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Web / CMS
  • Critical 9.8
    CVE-2026-39801

    WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.

    Sergey AIWU