Critical vulnerabilities
2 critical vulnerabilities in 2 WordPress plugins
2 vulnerabilities rated critical (CVSS 9.0 or higher) found on 6 November 2026: PHP object injection in WordPress plugins, Privilege escalation in WordPress plugins.
- 2 critical
PHP object injection in Radius Booking · WordPress plugins
CVE-2026-119516
WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability
- Severity
- Critical 9.8
- Published
- 6 Nov 2026
| Software | Affected versions |
|---|---|
| Radius Booking (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-119516
Privilege escalation in OAuth Single Sign On – SSO (OAuth Client) · WordPress plugins
CVE-2026-120844
WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability
- Severity
- Critical 9.8
- Published
- 6 Nov 2026
| Software | Affected versions |
|---|---|
| Miniorange Login With Eve Online Google Facebook (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-120844
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.