UpHeron
All posts

Critical vulnerabilities

31 critical vulnerabilities in 16 WordPress plugins, 7 servers and applications and the Doctreat WordPress theme

31 vulnerabilities rated critical (CVSS 9.0 or higher) found on 3 November 2026: Arbitrary file upload in WordPress plugins, Privilege escalation in WordPress plugins, Arbitrary file upload in WordPress themes and more.

  • 31 critical

Arbitrary file upload in WordPress plugins

4 vulnerabilities

  1. 10.0Kognetiks Chatbot for WordPressUp to 2.4.9CVE-2026-32579
  2. 9.9Workreap CoreUp to 3.4.5CVE-2026-39759
  3. 9.9TaskbotUp to 6.6CVE-2026-39757
  4. 9.9WP DuplicateUp to 1.1.11CVE-2026-39755

Privilege escalation in WordPress plugins

3 vulnerabilities

  1. 10.0Doctreat CoreUp to 1.7.0CVE-2026-39773
  2. 9.8Meta Box AIOUp to 3.7.1CVE-2026-39761
  3. 9.8TaskbotUp to 6.6CVE-2026-39753

Arbitrary file upload in WordPress themes

1 vulnerability

  1. 10.0DoctreatUp to 1.7.0CVE-2026-39770

Remote code execution in servers and applications

3 vulnerabilities

  1. 9.9LangflowLangflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the serverFixed in 1.9.0CVE-2026-105740
  2. 9.9LangflowLangflow: OS command injection (RCE) via arbitrary command in MCP stdio server configurationFixed in 1.10.3CVE-2026-105697
  3. 9.2SmartySmarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance CacheFixed in 4.5.8, 5.8.5CVE-2026-82531

Remote code execution in WordPress plugins

1 vulnerability

  1. 9.9WooCommerce Designer ProUp to 1.9.33CVE-2026-32568

PHP object injection in WordPress plugins

2 vulnerabilities

  1. 9.8GDPR Framework By Data443Up to 2.5.0CVE-2026-39797
  2. 9.8Advanced Post ManagerUp to 4.5.5CVE-2026-97283

SQL injection in servers and applications

1 vulnerability

  1. 9.8Payload CMSPayload: SQL Injection in SQLite and PostgresFixed in 3.88.0, 4.0.0-canary.27CVE-2026-105845

SQL injection in WordPress plugins

7 vulnerabilities

  1. 9.3ARMember PremiumUp to 7.8CVE-2026-42417
  2. 9.3PortoUp to 3.9.3CVE-2026-42415
  3. 9.3Newsletter Subscription FormUp to 1.5.9CVE-2026-41555
  4. 9.3SendPress NewslettersUp to 1.26.1.20CVE-2026-39795
  5. 9.3Gmedia Photo GalleryUp to 1.25.1CVE-2026-39785
Show 2 more
  1. 9.3Radius BookingUp to 1.0.19CVE-2026-39764
  2. 9.3WP BASE BookingUp to 6.4.0CVE-2026-103352

ZITADEL

4 vulnerabilities · Servers and applications · most fixed in 4.17.1

  1. 9.3ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP CallbackFixed in 3.4.14, 4.16.2CVE-2026-105215
  2. 9.3ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey EnrollmentFixed in 3.4.15, 4.17.1CVE-2026-105209
  3. 9.3ZITADEL before 4.17.3 Account Takeover via External IdP LinkingFixed in 4.17.3CVE-2026-105207
  4. 9.2ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCodeFixed in 4.17.1CVE-2026-105211

Cross-site scripting in servers and applications

2 vulnerabilities

  1. 9.3AVideoWWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video TitleUp to 29.2.0CVE-2026-105086
  2. 9.3AVideoWWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 TemplatesUp to 29.2.0CVE-2026-105089

Authentication bypass in servers and applications

1 vulnerability

  1. 9.2Snipe-ITSnipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the…Fixed in 8.6.3CVE-2026-116199

Other vulnerabilities in servers and applications

2 vulnerabilities

  1. 9.8vLLMvLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through…Fixed in 0.32.0CVE-2026-115915
  2. 9.3Payload CMSPayload: Prototype pollution in Payload Import Export pluginFixed in 3.88.0, 4.0.0-canary.27CVE-2026-105844

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.