Recent Advisories

Severity ID Title Vendor Product Date Type
CRITICAL 9.3 CVE-2026-49080

WordPress wpDataTables plugin <= 7.3.6 - SQL Injection vulnerability_CVE-2026-49080

Unauthenticated SQL Injection in wpDataTables

TMS wpDataTables n/a CVE
CRITICAL 9.9 CVE-2026-48781

Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery_CVE-2026-48781

Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob i...

gitroomhq postiz-app < 2.21.8 CVE
CRITICAL 10 CVE-2026-48055

Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction_CVE-2026-48055

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip v...

truelockmc streambert < 2.5.0 CVE
CRITICAL 9.8 CVE-2026-39529

WordPress Elementra theme <= 1.0.9 - PHP Object Injection vulnerability_CVE-2026-39529

Unauthenticated PHP Object Injection in Elementra

ThemeREX Group Elementra n/a CVE
CRITICAL 9.3 CVE-2026-39438

WordPress ListingPro plugin <= 2.9.10 - SQL Injection vulnerability_CVE-2026-39438

Unauthenticated SQL Injection in ListingPro

Emraan Cheema ListingPro n/a CVE
CRITICAL 9.8 CVE-2026-27429

WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability_CVE-2026-27429

Unauthenticated PHP Object Injection in Nifty

BoldThemes Nifty n/a CVE
CRITICAL 9.8 CVE-2026-27395

WordPress Support Board plugin < 3.8.9 - Privilege Escalation vulnerability_CVE-2026-27395

Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.

Schiocco Support Board n/a CVE
CRITICAL 10 CVE-2026-25470

WordPress ACPT (Pro) – Custom Post Types plugin for WordPress plugin <= 2.0.47 - Remote Code Execution (RCE) vulnerability_CVE-2026-25470

Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin for WordPress allows Remote C...

ACPT ACPT (Pro) - Custom Post Types Plugin for WordPress n/a CVE
CRITICAL 9.8 CVE-2025-69122

WordPress SeaFood Company theme <= 1.4 - PHP Object Injection vulnerability_CVE-2025-69122

Unauthenticated PHP Object Injection in SeaFood Company

ThemeREX SeaFood Company n/a CVE
CRITICAL 9.8 CVE-2025-69108

WordPress Hot Coffee theme <= 1.7 - PHP Object Injection vulnerability_CVE-2025-69108

Unauthenticated PHP Object Injection in Hot Coffee

ThemeREX Hot Coffee n/a CVE