CVE-2026-54xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
818 records · Page 1 of 9
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network.
UpdatedIncorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
UpdatedUse of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.
Updated- CVE-2026-54992: Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability 8.4 High
Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally.
Updated Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Updated- CVE-2026-54989: Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability 7.0 High
Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
Updated Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.
Updated- CVE-2026-54983: Windows Active Directory Federation Services Denial of Service Vulnerability 7.5 High
Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
Updated Integer underflow (wrap or wraparound) in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.
UpdatedInclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.
UpdatedOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abort in any application that calls exr_start_read() on untrusted input, resulting in denial of service. T
Updatedcpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL backend versions from 0.33.0 through 0.46.1, when cpp-httplib is built with CPPHTTPLIB_MBEDTLS_SUPPORT or CPPHTTPLIB_WOLFSSL_SUPPORT and a client connects to an IP-literal host with server certificate verification enabled, SSLClient and Clie
UpdatedNetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOX_DT_LIBRARY_URL in tests/test_configuration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the validation test harness runs. During pytest collection, tests/definitions_test.py passes the value
UpdatedSeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, obj
UpdatedNetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An unauthenticated contributor can add a module such as tests/git.py that shadows GitPython when tests/definition
UpdatedTautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default root HTTP_ROOT configuration, CherryPy HTTPRedirect passes the resulting value to ur
UpdatedUltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data in
UpdatedFileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the `path` parameter: it is passed d
Updatedpion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.
UpdatedPion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. This issue has been fixed in version 3.1.4.
UpdatedCaddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the user role without administrator approval. The user role cannot view or modify proxy data, so the direct
Updatedconcurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#
Updatedconcurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold count, and bit 15 is used as WRITE_LOCK_HELD. After 32,768 reentrant read acquisition
Updatedconcurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReference#update, which retries until compare_and_set(old_value, new_value) succeeds; Numeric compare_and_set, which checks old == old_value before attempting the u
UpdatedOj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in buf_append_string (buf.h:61) converts the string length to a large negative size_t, causing memcpy to copy an astronomically large amount of data out of bounds. This crashes the p
UpdatedOj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object keys (≥ 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause the key string to be reclaimed while the C parser still holds a pointer to it. The subsequ
UpdatedOj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garbage collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse, the class object is reclaimed, leaving the parser holding a dangling VALUE. The subsequent parse c
UpdatedOj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj::Parser#parse is vulnerable to heap corruption via a negative-size memcpy. When a JSON object key is exactly 65,535 bytes long, an integer truncation in form_attr (usual.c:63) converts the length to -1 before passing it to memcpy. This causes
UpdatedOj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free) but does not clear the pointer. The next parse call reads from the freed cache via cache_intern,
UpdatedOj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2,Oj::Parser#parse is vulnerable to a heap use-after-free when a SAJ/SAJ2 callback mutates the input JSON string during parsing. The C engine holds a raw const byte * pointer into the Ruby string's internal buffer. If a callback (e.g. hash_start) resizes the string — for example by calling
UpdatedOj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads fr
Updated- CVE-2026-54896: Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent 2.1 Low
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in object mode, Oj.dump is vulnerable to a heap buffer overflow when serializing Exception objects with a large :indent value. The serializer allocates a buffer sized for the object's attributes but does not account for the indent bytes added on each write. With indent: 5000, the ac
Updated Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpe
UpdatedURL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path (/users/{from}/sendMail) without percent-encoding or validation. In applications that derive the from address from untrusted or user-influenced input (for example a relay, a contact form, or a "send as" featur
UpdatedInefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 (and Plug.Conn.Query.decode_each/2) parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many bracketed segments such as a[a][a][a]=1, the decoder walks the brackets and, for each of the N level
UpdatedImproper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. The function tls_gen_connection:handle_protocol_record/3 rejects APPLICATION_DATA records that arrive
Updated- CVE-2026-54890: BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding 8.2 High
Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both len
Updated - CVE-2026-54889: Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS) 5.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Quill Delta output. 'Elixir.MDEx':to_delta/2 converts Markdown into a Quill Delta. 'Elixir.MDEx.DeltaConverter':default_convert_node/3 in lib/mdex/delta_converter.ex copies the URL of a link, wikilink, or image node directly from the parsed M
Updated - CVE-2026-54888: Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex 6.9 Medium
Uncontrolled Recursion vulnerability in leandrocp mdex allows denial of service via deeply nested Markdown input. mdex converts between an Elixir %MDEx.Document{} struct and Comrak's internal AST using two mutually recursive Rust functions, ex_document_to_comrak_ast and comrak_ast_to_ex_document, in the NIF source file document.rs. Neither function enforces a maximum nesting depth, so the recursi
Updated - CVE-2026-54887: DTLS server cookie bypass during startup window due to empty initial cookie secret 6.3 Medium
Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary (<<>>) instead of a random value. Because HMAC with an empty key is deterministic, anyo
Updated - CVE-2026-54886: SSH SFTP server denial of service via extended channel data infinite loop 5.3 Medium
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pe
Updated - CVE-2026-54885: Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching 6.9 Medium
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote URIs supplied by the requester without sufficient validation of the target. Boruta.Oauth.Request.Base.f
Updated Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memor
UpdatedIssue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption on an affected platform can learn information about the secret scalar. CWE: CWE-208: Observable Timin
UpdatedIssue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumptio
UpdatedIssue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote pee
UpdatedIssue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Numbe
UpdatedMissing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.2.
UpdatedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1.
UpdatedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1.
Updated- CVE-2026-54868: WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7.
Updated Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Griden Responsive Slider responsive-slider allows Stored XSS.This issue affects Responsive Slider: from n/a through 0.1.9.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.
UpdatedSubscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.
UpdatedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9.
UpdatedUnauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
Updated- CVE-2026-54859: WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability 9.8 Critical
Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.
Updated Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
UpdatedUnauthenticated PHP Object Injection in Quirky <= 1.23 versions.
UpdatedUnauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
Updated- CVE-2026-54855: WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.
Updated - CVE-2026-54854: WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability 6.3 Medium
Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.
Updated - CVE-2026-54853: WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability 5.3 Medium
Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5.
Updated Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1.
UpdatedSubscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.
Updated- CVE-2026-54849: WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerability 9.3 Critical
Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.
Updated Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.
UpdatedUnauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.
UpdatedUnauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.
UpdatedUnauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.
UpdatedUnauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.
UpdatedUnauthenticated SQL Injection in MDTF <= 1.3.7 versions.
UpdatedMissing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.
UpdatedUnauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.
UpdatedUnauthenticated Broken Access Control in Newsletters <= 4.13 versions.
UpdatedUnauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.
Updated- CVE-2026-54838: WordPress WC Vendors Marketplace plugin <= 2.6.8 - SQL Injection vulnerability 8.5 High
Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.
Updated Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions.
Updated- CVE-2026-54836: WordPress Filter & Grids plugin <= 3.11.5 - SQL Injection vulnerability 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5.
Updated Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.
UpdatedUnauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions.
UpdatedUnauthenticated Backdoor in Enable CORS <= 2.0.3 versions.
Updated- CVE-2026-54832: WordPress Gutenverse Companion plugin <= 2.5.0 - Broken Access Control vulnerability 7.5 High
Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.
Updated Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.
UpdatedUnauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.
Updated- CVE-2026-54829: WordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerability 7.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.
Updated Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.
UpdatedUnauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.
UpdatedSubscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.
UpdatedUnauthenticated SQL Injection in wpDataTables <= 7.4 versions.
Updated- CVE-2026-54824: WordPress Ads by WPQuads plugin <= 3.0.3 - Sensitive Data Exposure vulnerability 7.5 High
Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions.
Updated - CVE-2026-54823: WordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerability 9.9 Critical
Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.
Updated