Skip to content
OpenAdvisories

Source

ENISA EU Vulnerability Database

Source: https://euvd.enisa.europa.eu/

All Critical High Medium Low Exploited only Public exploit

406,158 results · Feed

  • Critical 9.8
    CVE-2026-62131

    WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

    Zoho Flow Zoho Flow
  • Critical 9.8
    CVE-2026-62017

    WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

    ThemeREX Good Homes
  • Critical 9.8
    CVE-2026-62016

    WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

    ThemeREX Gamic
  • Critical 9.8
    CVE-2026-62015

    WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

    ThemeREX Gamezone
  • Critical 9.8
    CVE-2026-62014

    WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

    ThemeREX EmojiNation
  • Critical 9.8
    CVE-2026-62013

    WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

    ThemeREX Edge Decor Browsers
  • Critical 9.8
    CVE-2026-62012

    WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

    ThemeREX Coinpress
  • Critical 9.8
    CVE-2026-62010

    WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

    ThemeREX Avventure
  • Critical 9.8
    CVE-2026-62011

    WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

    ThemeREX Bonbon
  • Critical 9.8
    CVE-2026-62009

    WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

    ThemeREX Filmax
  • Critical 9.8
    CVE-2026-62008

    WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

    ThemeREX Orpheus
  • Critical 9.8
    CVE-2026-62006

    WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

    ThemeREX Nuts
  • Critical 9.8
    CVE-2026-62005

    WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

    ThemeREX Muzicon
  • Critical 9.8
    CVE-2026-62004

    WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

    ThemeREX Motorix
  • Critical 9.8
    CVE-2026-62003

    WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

    ThemeREX Mission
  • Critical 9.8
    CVE-2026-62002

    WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

    ThemeREX Meals & Wheels
  • Critical 9.8
    CVE-2026-62001

    WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

    ThemeREX Marcell
  • Critical 9.8
    CVE-2026-61998

    WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

    ThemeREX Le Truffe
  • Critical 9.8
    CVE-2026-61997

    WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

    ThemeREX Legal Stone
  • High 8.5
    CVE-2026-61996

    WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

    Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

    Fave Themes MLS On The Fly
  • High 7.1
    CVE-2026-61993

    WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.

    blockonomics Blockonomics
  • High 7.1
    CVE-2026-61995

    WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

    emarket-design YouTube Showcase
  • Critical 9.8
    CVE-2026-61992

    WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

    Von Eyal Fitoussi GEO my WordPress Web / CMS
  • Critical 10.0
    CVE-2026-61991

    WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability

    Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

    Ajax Load More AjaxLoadMore Cache
  • High 7.1
    CVE-2026-61989 Public exploit

    WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.

    Merv Barrett Easy Property Listings
  • High 7.1
    CVE-2026-61988

    WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.

    morehawes Auction Nudge – Your eBay on Your Site
  • High 7.1
    CVE-2026-54866

    WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

    Razorpay Razorpay Payment Button Elementor Plugin
  • Medium 6.5
    CVE-2026-54865

    WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.

    Podamibe Nepal Podamibe Custom User Gravatar
  • Critical 9.8
    CVE-2026-54860

    WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

    ThemeREX Ozisti
  • High 7.1
    CVE-2026-54864

    WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.

    nicashmu Post Video Players
  • Critical 9.8
    CVE-2026-54859

    WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

    ThemeREX Preservation
  • Critical 9.8
    CVE-2026-54858

    WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

    ThemeREX Printy
  • Critical 9.8
    CVE-2026-54856

    WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

    ThemeREX RexCoin
  • Critical 9.8
    CVE-2026-54857

    WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

    ThemeREX Quirky
  • High 7.2
    CVE-2026-42701

    WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability

    Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.

    YayCommerce YayMail
  • High 7.1
    CVE-2026-42692

    WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.

    Themeum WP Crowdfunding
  • Medium 5.4
    CVE-2026-42690

    WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

    Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.

    ThimPress LearnPress
  • High 7.1
    CVE-2026-118085

    WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.

    Global Payments GlobalPayments WooCommerce Web / CMS
  • High 7.1
    CVE-2026-27394

    WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.

    Jyothis Joy Eventer
  • Medium 5.3
    CVE-2026-66912

    Stored Cross-Site Scripting in Zimbra

    Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From …

    Synacor Zimbra Collaboration