Boletim de segurança de 10 de outubro de 2026

CVE-2026-42696

Unauthenticated Remote Code Execution (RCE) in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.19 versions.

CVE-2026-62129

Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

CVE-2026-62024

Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.

CVE-2026-108707

Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download...

CVE-2026-81797

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

CVE-2026-78535

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

CVE-2026-78533

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

CVE-2026-78531

Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

CVE-2026-78529

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

CVE-2026-66569

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

CVE-2026-66568

Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

CVE-2026-66567

Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

CVE-2026-66565

Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

CVE-2026-66564

Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

CVE-2026-66563

Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

CVE-2026-66483

Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

CVE-2026-66482

Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

CVE-2026-62125

Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

CVE-2026-62124

Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

CVE-2026-62123

Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

CVE-2026-62120

Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

CVE-2026-62090

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

CVE-2026-62087

Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

CVE-2026-62086

Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

CVE-2026-62077

Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

CVE-2026-62076

Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

CVE-2026-62054

Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

CVE-2026-62053

Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

CVE-2026-62052

Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

CVE-2026-62051

Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

CVE-2026-62050

Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

CVE-2026-62032

Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.

CVE-2026-62022

Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

CVE-2026-42723

Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

CVE-2026-42719

Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

CVE-2026-42718

Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

CVE-2026-42716

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

CVE-2026-39801

Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.

CVE-2026-108598

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder,...

CVE-2026-106610

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.

CVE-2026-105892

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.

CVE-2026-104398

Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.

CVE-2026-108551

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url,...

CVE-2026-93945

Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.

CVE-2026-93944

Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.

CVE-2026-93943

Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.

CVE-2026-93942

Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.

CVE-2026-93941

Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.

CVE-2026-93940

Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.

CVE-2026-93938

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.

CVE-2026-93937

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.

CVE-2026-93936

Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.

CVE-2026-93935

Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.

CVE-2026-93934

Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.

CVE-2026-93933

Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.

CVE-2026-93932

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.

CVE-2026-93931

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.

CVE-2026-93930

Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.

CVE-2026-93929

Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.

CVE-2026-93927

Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.

CVE-2026-62046

Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.

CVE-2026-62045

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

CVE-2026-104803

The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce...

CVE-2026-103889

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image...

CVE-2026-94589

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's...

CVE-2026-104732

The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_action()` performs no server-side check — via transient, session marker, or equivalent — that a requester completed step-1 password...

CVE-2026-62031

Unauthenticated SQL Injection in uListing <= 2.2.0 versions.

CVE-2026-40800

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

CVE-2026-105889

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.

CVE-2026-104801

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on...

CVE-2026-97670

The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the...

CVE-2026-107645

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then...

CVE-2026-62025

Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.