PHP vulnerabilities

Latest PHP CVEs

Newest publication first · page 16 of 40 · showing the latest 1,000

1. CVE-2026-120333 Broken Access Control in extension "Frontend User Registration" (sf_register)

   Published 2026-11-03

   High·CVSS 8.8 EPSS 0.39%

   The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these a...

2. CVE-2026-120578 AI Alt Text Generator <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter

   Published 2026-11-03

   Medium·CVSS 5.3 EPSS 0.26%

   The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

3. CVE-2026-120577 FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter

   Published 2026-11-03

   High·CVSS 8.1 EPSS 0.61%

   The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authentic...

4. CVE-2026-120524 News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action

   Published 2026-11-03

   Medium·CVSS 6.4 EPSS 0.19%

   The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attack...

5. CVE-2026-120559 Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal

   Published 2026-11-03

   High·CVSS 7.5 EPSS 0.67%

   The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefd_remove_uploaded_file() function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated a...

6. CVE-2026-120544 Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route

   Published 2026-11-03

   Medium·CVSS 4.3 EPSS 0.34%

   The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access a...

7. CVE-2026-120518 BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler

   Published 2026-11-03

   Critical·CVSS 9.1 EPSS 0.78%

   The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with n...

8. CVE-2026-111464 WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response

   Published 2026-11-03

   Medium·CVSS 5.9 EPSS 0.42%

   The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INST...

9. CVE-2026-106991 hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The....

   Published 2026-11-03

   High·CVSS 7.1 EPSS 0.37%

   hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.

10. CVE-2026-120597 Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting

    Published 2026-11-02

    Medium·CVSS 5.3 EPSS 0.60%

    A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attac...

11. CVE-2026-86596 s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

    Published 2026-11-02

    Critical·CVSS 9.8 EPSS 1.5%

    The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined...

12. CVE-2026-102435 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

    Published 2026-11-02

    Critical·CVSS 9.8 EPSS 0.59%

    The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbi...

13. CVE-2026-105605 Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3

    Published 2026-11-02

    Medium·CVSS 5.3 EPSS 0.29%

    Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by its raw numeric ID with no check that the ad b...

14. CVE-2026-73696 Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex

    Published 2026-11-02

    High·CVSS 8.6 EPSS 0.49%

    Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location...

15. CVE-2026-73695 Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php

    Published 2026-11-02

    High·CVSS 8.7 EPSS 0.95%

    Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attack...

16. CVE-2026-120425 Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint

    Published 2026-11-02

    High·CVSS 7.1 EPSS 0.52%

    Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chati...

17. CVE-2026-102802 Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1

    Published 2026-11-02

    High·CVSS 8.9 EPSS 0.39%

    Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release....

18. CVE-2026-103420 Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5

    Published 2026-11-02

    High·CVSS 7.2 EPSS 0.20%

    Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5

19. CVE-2026-105600 Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5

    Published 2026-11-02

    High·CVSS 8.6 EPSS 0.39%

    Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5

20. CVE-2026-105601 Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5

    Published 2026-11-02

    Medium·CVSS 5.3 EPSS 0.40%

    Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5

21. CVE-2026-120349 dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection

    Published 2026-11-02

    Medium·CVSS 6.9 EPSS 0.30%

    A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack...

22. CVE-2026-120348 dayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injection

    Published 2026-11-02

    Medium·CVSS 6.9 EPSS 0.30%

    A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initia...

23. CVE-2026-120347 dayrui XunRuiCMS Member View.php View sql injection

    Published 2026-11-02

    Medium·CVSS 6.9 EPSS 0.33%

    A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remote...

24. CVE-2026-120343 mathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scripting

    Published 2026-11-02

    Medium·CVSS 5.3 EPSS 0.26%

    A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotel...

25. CVE-2026-120342 mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection

    Published 2026-11-02

    Medium·CVSS 6.9 EPSS 0.32%

    A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.