UpHeron
All posts

Daily summary

Vulnerabilities of 24 October 2026: 40 new, 7 critical

40 vulnerabilities added on 24 October 2026, 7 critical and 15 high: PHP object injection in WordPress plugins, SQL injection in WordPress plugins, Privilege escalation in WordPress plugins and more.

  • 7 critical
  • 15 high
  • 14 medium
  • 1 low
  • 3 unrated

PHP object injection in WordPress plugins

4 vulnerabilities

  1. 9.8PaytiumUp to 5.0.5CVE-2026-114196
  2. 9.8NewslettersUp to 4.18.1CVE-2026-94075
  3. 9.8Prime MoverUnauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-ReplaceUp to 2.2.1CVE-2026-115806
  4. 7.2RelevanssiUp to 4.28.4CVE-2026-114704

SQL injection in WordPress plugins

2 vulnerabilities

  1. 9.3Product Filter by WBWUp to 3.4.6CVE-2026-112866
  2. 9.3NewslettersUp to 4.18.1CVE-2026-111402

Privilege escalation in WordPress plugins

2 vulnerabilities

  1. 8.8aBlocksAuthenticated (Contributor+) Privilege Escalation to 'roleSlug' Block AttributeUp to 2.17.0CVE-2026-110018
  2. 7.1Profile BuilderAuthenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' AttributeUp to 4.0.3CVE-2026-115807

PHP

8 vulnerabilities · Servers and applications · most fixed in 8.2.34, 8.3.35, 8.4.26

  1. 7.5cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request…Fixed in 8.4.26, 8.5.11CVE-2026-91765
  2. 6.9On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$…Fixed in 8.4.26, 8.5.11CVE-2026-17545
  3. 6.5The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed…Fixed in 8.4.26, 8.5.11CVE-2025-14181
  4. 5.9When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when…Fixed in 8.4.26, 8.5.11CVE-2026-91766
  5. 5.9The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or…Fixed in 8.4.26, 8.5.11CVE-2025-1218
Show 3 more
  1. 5.8When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end…Fixed in 8.4.26, 8.5.11CVE-2026-93682
  2. 4.3PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name.…Fixed in 8.4.26, 8.5.11CVE-2026-91769
  3. 3.3phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to…Fixed in 8.4.26, 8.5.11CVE-2026-6103

Broken access control in WordPress plugins

4 vulnerabilities

  1. 7.5UPI QR Code Payment Gateway for WooCommerceUp to 1.6.3CVE-2026-114191
  2. 6.5WpEventlyUp to 5.7.8CVE-2026-114192
  3. 6.5WP Social Feed GalleryUp to 5.0.13CVE-2026-114705
  4. 6.5SureDashUp to 1.12.2CVE-2026-110892

Denial of service in npm packages

3 vulnerabilities

  1. 7.5undiciundici vulnerable to Denial of Service via unhandled error on excessive content-encodingsFixed in 7.30.1, 8.12.2CVE-2026-109869
  2. 7.5body-parserbody-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodyFixed in 1.20.9, 2.4.0CVE-2026-111181
  3. 5.9undiciundici vulnerable to Denial of Service via unbounded memory in the EventSource parserFixed in 7.30.1, 8.12.2CVE-2026-109924

Cross-site scripting in WordPress plugins

9 vulnerabilities

  1. 7.1Events ManagerUp to 7.4.8CVE-2026-114694
  2. 7.1VOD InfomaniakUp to 1.5.14CVE-2026-114695
  3. 7.1QA AnalyticsUp to 5.3.0.1CVE-2026-114697
  4. 7.1WP Event SolutionUp to 4.1.26CVE-2026-112844
  5. 7.1We’re Open!Up to 2.6CVE-2026-112869
Show 4 more
  1. 7.1BP Better MessagesUp to 3.1.3CVE-2026-114179
  2. 7.1W3 Total CacheVulnerability in W3 Total CacheFixed in 2.11.0CVE-2026-114178
  3. 6.5Ad InserterUp to 2.8.18CVE-2026-114194
  4. 6.5All-in-One Video GalleryUp to 4.9.7CVE-2026-114693

LiteSpeed Cache

4 vulnerabilities · WordPress plugins · most fixed in 7.9.2

  1. 5.9Vulnerability in LiteSpeed CacheFixed in 7.9.1CVE-2026-114190
  2. –LiteSpeed Cache: Cross-site ScriptingFixed in 7.9.2CVE-2026-113499
  3. –LiteSpeed Cache: Cross-site ScriptingFixed in 7.9.2CVE-2026-113500
  4. –LiteSpeed Cache: Missing AuthorizationFixed in 7.9.2CVE-2026-113501

Servers and applications

2 vulnerabilities

  1. 9.4PythonDistrust compromised intermediate certificates in ssl moduleFixed in 3.15.2, 3.16.0CVE-2026-115557
  2. 9.1JavaVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions…Up to 21.0.13.0.2CVE-2026-114820

Other vulnerabilities in npm packages

2 vulnerabilities

  1. 7.5zodZod can exhaust memory while validating oversized constrained collectionsFixed in 4.6.6CVE-2023-54404
  2. 5.9undiciundici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensFixed in 7.30.1, 8.12.2CVE-2026-109841

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.