PHP vulnerabilities

Latest PHP CVEs

Newest publication first · page 10 of 40 · showing the latest 1,000

1. CVE-2026-124456 OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module

   Published 2026-11-08

   High·CVSS 7.1 EPSS 0.22%

   OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/li...

2. CVE-2026-124452 OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes

   Published 2026-11-08

   Medium·CVSS 5.1 EPSS 0.17%

   OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a reti...

3. CVE-2026-124453 OpenEMR before 8.3.0 IDOR in Portal Patient Settings via persist.php

   Published 2026-11-08

   High·CVSS 7.1 EPSS 0.20%

   OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to write settings for other patients. Attackers can modify the setting_patient parameter in a JSON POST request to another patient's...

4. CVE-2026-124451 OpenEMR before 8.4.0 Authorization Bypass via checkUserHasAccessToPatient in SMART on FHIR

   Published 2026-11-08

   Medium·CVSS 6.0 EPSS 0.25%

   OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token lau...

5. CVE-2026-124450 OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument

   Published 2026-11-08

   Critical·CVSS 9.3 EPSS 0.49%

   OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary f...

6. CVE-2026-124446 OpenEMR before 8.3.0 Arbitrary File Read and Write via FaxSMS disposeDocument

   Published 2026-11-08

   High·CVSS 8.7 EPSS 0.35%

   OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low-privilege users to read and overwrite arbitrary files via the unsanitized file_path parameter. Attackers ca...

7. CVE-2026-124445 OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force

   Published 2026-11-08

   Critical·CVSS 9.3 EPSS 0.35%

   OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a cap...

8. CVE-2026-124430 Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle

   Published 2026-11-08

   High·CVSS 8.7 EPSS 0.58%

   Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirec...

9. CVE-2026-124428 Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg

   Published 2026-11-08

   High·CVSS 7.1 EPSS 0.34%

   Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without per...

10. CVE-2026-124424 WWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.php

    Published 2026-11-08

    High·CVSS 7.1 EPSS 0.38%

    WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized response[lang] parameter. Attackers can send a type=translation req...

11. CVE-2026-114432 Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename

    Published 2026-11-08

    Critical·CVSS 9.8 EPSS 0.46%

    The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. O...

12. CVE-2026-120839 WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

    Published 2026-11-07

    High·CVSS 8.8 EPSS 0.41%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

13. CVE-2026-120841 WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

    Published 2026-11-07

    High·CVSS 8.8 EPSS 0.41%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

14. CVE-2026-104746 Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta

    Published 2026-11-07

    High·CVSS 8.1 EPSS 0.95%

    The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the stm_listings_ajax_save_user_data function in all versions up to, and including, 1.4.125 This makes it possible fo...

15. CVE-2026-96565 WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field

    Published 2026-11-07

    Medium·CVSS 6.4 EPSS 0.34%

    The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input sanitization a...

16. CVE-2026-118066 Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter

    Published 2026-11-07

    Critical·CVSS 9.1 EPSS 2.3%

    The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the OsModel::build_conditions_query() function in lib/mode...

17. CVE-2026-103900 WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter

    Published 2026-11-07

    High·CVSS 8.1 EPSS 0.42%

    The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup::signup() function unpacking attacker-supplied data[args] from the AJAX POST body and merging it via PHP array union into the payl...

18. CVE-2026-119164 wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter

    Published 2026-11-07

    High·CVSS 7.5 EPSS 0.38%

    The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the data[secondary_groupids] parameter of the wpforo_action_profile_update POST handler. This is due to a type-confusion flaw in the secondary_groupids auth...

19. CVE-2026-120548 YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php

    Published 2026-11-07

    Medium·CVSS 5.3 EPSS 0.32%

    The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Marke...

20. CVE-2026-110004 wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter

    Published 2026-11-07

    Medium·CVSS 6.5 EPSS 0.73%

    The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function in all versions up to, and including, 3.2.2 This makes it possible for authenticated attackers, with subscriber-level access and ab...

21. CVE-2026-104738 Advanced Form Integration <= 2.10.2 - Unauthenticated PHP Object Injection via $_POST Parameters

    Published 2026-11-07

    High·CVSS 8.1 EPSS 0.45%

    The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.2 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object....

22. CVE-2026-120537 TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint

    Published 2026-11-07

    High·CVSS 7.2 EPSS 0.25%

    The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (storage); originals / language / original_language (exfiltration from endpoint)' parameter in all versions up to, and includin...

23. CVE-2026-122265 Vanquish Upload Files for WooCommerce <= 2.7.13 - Unauthenticated Arbitrary File Read via 'vanupfi_file_name' Parameter

    Published 2026-11-07

    Medium·CVSS 5.9 EPSS 0.74%

    The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the 'vanupfi_file_name' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and a...

24. CVE-2026-87112 QA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parameters

    Published 2026-11-07

    High·CVSS 8.8 EPSS 0.80%

    The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter. This is due to unrestricted PHP deserialization via wrap_unserialize_static() calling unserialize() without a...

25. CVE-2026-120515 SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' Parameters

    Published 2026-11-07

    Medium·CVSS 6.4 EPSS 0.20%

    The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' settings in versions up to, and including, 10.3. This is due to in...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.