Threat Entry Updated 2026-06-17

CVE-2026-49774 - RD Station Plugin

Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0.

PLUGIN RD Station

CVE-2026-49774

CRITICAL CVSS 9.9 2026-06-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49772 - The Events Calendar Plugin

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.

PLUGIN The Events Calendar

CVE-2026-49772

CRITICAL CVSS 9.3 2026-06-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-39574 - WordPress component

Unauthenticated SQL Injection in InPost Gallery

UNKNOWN WordPress component

CVE-2026-39574

CRITICAL CVSS 9.3 2026-06-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-9691 - Contact Form 7 Plugin

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms

PLUGIN Contact Form 7

CVE-2026-9691

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-52703 - WordPress component

Unauthenticated Path Traversal in FastDup

UNKNOWN WordPress component

CVE-2026-52703

CRITICAL CVSS 9.6 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-52693 - WordPress component

Unauthenticated SQL Injection in eCommerce Product Catalog

UNKNOWN WordPress component

CVE-2026-52693

CRITICAL CVSS 9.3 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49781 - WordPress component

Unauthenticated PHP Object Injection in OttoKit

UNKNOWN WordPress component

CVE-2026-49781

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49770 - WordPress component

Unauthenticated PHP Object Injection in WP Travel Engine

UNKNOWN WordPress component

CVE-2026-49770

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49776 - WordPress component

Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites

UNKNOWN WordPress component

CVE-2026-49776

CRITICAL CVSS 9.3 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49766 - WordPress component

Subscriber Arbitrary File Deletion in WP User Manager

UNKNOWN WordPress component

CVE-2026-49766

CRITICAL CVSS 9.9 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49769 - WordPress component

Unauthenticated PHP Object Injection in wpForo Forum

UNKNOWN WordPress component

CVE-2026-49769

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49768 - WordPress component

Unauthenticated PHP Object Injection in Happyforms

UNKNOWN WordPress component

CVE-2026-49768

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49765 - Contact Form 7 Plugin

Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms

PLUGIN Contact Form 7

CVE-2026-49765

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49764 - WordPress component

Unauthenticated Broken Authentication in RegistrationMagic

UNKNOWN WordPress component

CVE-2026-49764

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-08

CVE-2026-49763 - Integration for Contact Form 7 HubSpot Plugin

Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot

PLUGIN Integration for Contact Form 7 HubSpot

CVE-2026-49763

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49109 - Contact Form 7 Plugin

Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms

PLUGIN Contact Form 7

CVE-2026-49109

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49106 - Contact Form 7 Plugin

Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact

PLUGIN Contact Form 7

CVE-2026-49106

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49105 - Contact Form 7 Plugin

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms

PLUGIN Contact Form 7

CVE-2026-49105

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49104 - Contact Form 7 Plugin

Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms

PLUGIN Contact Form 7

CVE-2026-49104

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49085 - Contact Form 7 Plugin

Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms

PLUGIN Contact Form 7

CVE-2026-49085

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown