Critical vulnerabilities, curated daily for security professionals
A large set of CRM Perks WordPress integration plugins—covering Salesforce, Zendesk, HubSpot, Keap/Infusionsoft, Mailchimp, and Constant Contact connectors—account for most of the day's critical disclosures, each rated CVSS 9.8. The brief includes 30 critical CVEs, up from none the prior day, and 62 high-priority CVEs, an 11% increase over the previous 56. Notable critical entries include CVE-2026-48114 in DataONE Metacat (CVSS 9.8), CVE-2026-49109 in CRM Perks Integration for Salesforce (CVSS 9.8), and CVE-2018-25436 in the Baggage Freight Shipping Australia WordPress plugin (CVSS 9.8). Active exploitation spans enterprise infrastructure, with KEV-listed flaws in Cisco Catalyst SD-WAN Manager, Ivanti Sentry, Oracle PeopleSoft PeopleTools, Arista EOS, and Microsoft Exchange Server. No patches are currently flagged as available across these disclosures, so teams should prioritize mitigations and exposure reduction while monitoring vendors for fixes.
Immediate action: Prioritize the actively exploited enterprise systems—Cisco Catalyst SD-WAN Manager, Ivanti Sentry, Oracle PeopleSoft PeopleTools, Arista EOS, and Microsoft Exchange Server—for immediate review and mitigation, and audit WordPress sites running CRM Perks integration plugins or the affected DataONE Metacat and Broadcast Live Video components. With no patches currently available across these disclosures, apply vendor mitigations, restrict exposure of affected services, and monitor advisories for forthcoming fixes.
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
Spring Data Commons contains a property binder vulnerability that allows unauthenticated remote attackers to execute arbitrary code via crafted request parameters.
A critical OS command injection vulnerability in Ivanti Sentry allows remote unauthenticated users to achieve root-level remote code execution.
An unauthenticated, easily exploitable vulnerability in the PeopleSoft Updates Environment Management component allows for complete system takeover via HTTP.
An out-of-bounds read and write vulnerability in the V8 JavaScript engine allows remote attackers to execute arbitrary code via a crafted HTML page.
Arista Extensible Operating System is affected by an incomplete comparison vulnerability, currently tracked in the CISA KEV catalog.
A command injection and privilege escalation vulnerability exists in the CLI of Cisco Catalyst SD-WAN Manager due to insufficient input validation.
Cisco Catalyst SD-WAN Manager contains an arbitrary file write vulnerability in its web UI, allowing authenticated remote attackers to escalate privileges to root.
A symlink mishandling vulnerability in the LiteSpeed cPanel plugin allows users with limited access to escalate privileges on shared hosting environments.
A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server allows unauthenticated attackers to perform spoofing over a network.
The WordPress Baggage Freight Shipping Australia plugin contains an unrestricted file upload vulnerability allowing unauthenticated remote code execution.
Metacat data repository software contains an unauthenticated SQL injection vulnerability allowing full database read/write/execute access.
An unauthenticated PHP object injection vulnerability in the Broadcast Live Video plugin for WordPress allows remote code execution.
An unauthenticated PHP Object Injection vulnerability exists in the WP Insightly integration plugin for various WordPress form builders, allowing potential remote code execution.
An unauthenticated PHP Object Injection vulnerability in the CRM Perks Integration for Keap/infusionsoft allows remote attackers to perform deserialization of untrusted data.
An unauthenticated PHP Object Injection vulnerability in the WP Zendesk integration for WordPress allows attackers to execute arbitrary code via deserialization of untrusted data.
An unauthenticated PHP Object Injection vulnerability exists in the CRM Perks Integration for Contact Form 7 and Constant Contact, enabling potential remote code execution.
An unauthenticated PHP Object Injection vulnerability in the CRM Perks Integration for Salesforce allows remote attackers to achieve arbitrary code execution.
The Integration for Contact Form 7 HubSpot plugin for WordPress is vulnerable to unauthenticated PHP Object Injection, potentially allowing remote code execution via serialized input.
The Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress suffers from unauthenticated PHP Object Injection via deserialization of untrusted input.
The Happyforms plugin for WordPress is susceptible to unauthenticated PHP Object Injection, which could allow attackers to execute arbitrary code or retrieve sensitive data.
The wpForo Forum plugin for WordPress is vulnerable to unauthenticated PHP Object Injection, enabling potential remote code execution via untrusted input deserialization.
The WP Travel Engine plugin for WordPress contains an unauthenticated PHP Object Injection vulnerability, which could be exploited to compromise the system.
An unauthenticated PHP Object Injection vulnerability exists in the OttoKit component of the SureTriggers WordPress plugin, potentially leading to remote code execution.
An unauthenticated PHP Object Injection vulnerability (CWE-502) affects the Integration for ActiveCampaign and various form plugins, potentially allowing remote code execution.
Fortra's Core Privileged Access Manager contains an OS command injection vulnerability in the boks_autoregisterd service that allows remote code execution.
The WP MAPS PRO WordPress plugin allows unauthenticated attackers to create administrator accounts via an improperly secured AJAX action.
A code injection vulnerability in the WooCommerce PDF Invoice Builder plugin allows unauthenticated remote attackers to perform remote code inclusion.
Easy Invoice contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands on the server.
The Feed KuantoKusta for WooCommerce plugin contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries.
iControlWP contains an unauthenticated privilege escalation vulnerability that allows remote attackers to gain elevated access to the system.
An unauthenticated privilege escalation vulnerability exists in the Datalogics Ecommerce Delivery WordPress plugin, allowing attackers to gain administrative access.
The WP Maps plugin for WordPress is vulnerable to unauthenticated SQL injection, enabling attackers to extract sensitive information from the database.
An unauthenticated SQL injection vulnerability in the Simply Schedule Appointments plugin allows attackers to extract sensitive database information.
The Form Maker by 10Web plugin for WordPress is vulnerable to unauthenticated SQL injection, allowing attackers to extract information from the database.
The GeekyBot WordPress plugin is susceptible to an unauthenticated arbitrary file upload vulnerability, which can lead to remote code execution.
An arbitrary file upload vulnerability exists in the WP-BusinessDirectory plugin for WordPress, allowing attackers to upload malicious files.
An arbitrary file deletion vulnerability in the WP User Manager plugin for WordPress allows authenticated users to delete sensitive system files.
A broken authentication vulnerability in the RegistrationMagic plugin for WordPress allows unauthenticated attackers to bypass security controls.
An unauthenticated path traversal vulnerability exists in the FastDup plugin for WordPress, allowing attackers to access sensitive files.
A high-severity vulnerability affects the DbGate cross-platform database manager.
A PHP object injection vulnerability exists in the Anti-Malware Security and Brute-Force Firewall plugin for WordPress, allowing authenticated contributors to execute arbitrary code.
A SQL injection vulnerability exists in the ELEX WordPress HelpDesk & Customer Ticketing System affecting version 3 and below.
The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution due to missing authorization checks in versions up to 2.
A vulnerability exists in the WordPress Ultimate Product Catalog plugin, requiring immediate investigation.
A PHP object injection vulnerability in the Post Duplicator plugin for WordPress allows authenticated contributors to perform unauthorized actions or execute code.
The Events Calendar for GeoDirectory plugin for WordPress contains a PHP object injection vulnerability accessible to authenticated contributors.
A privilege escalation vulnerability in Microsoft Exchange Server due to weak authentication allows an authorized attacker to elevate privileges over a network.
An incorrect implementation of an authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.
A security vulnerability exists in the WordPress Booking Calendar Contact Form plugin that may allow for unauthorized access or execution.
A security flaw has been identified in the WordPress Booking Calendar Contact Form, potentially impacting the confidentiality and integrity of the site.
The WordPress 404 Redirection Manager plugin contains a security vulnerability that may expose the application to unauthorized actions.
The BBS e-Franchise plugin for WordPress is affected by a security vulnerability that could lead to unauthorized system access.
The Answer My Question plugin for WordPress contains a security vulnerability that may allow for unauthorized access or data manipulation.
A sandbox bypass vulnerability in Foxit AI allows remote code execution when processing malicious PDF files containing embedded JavaScript.
Spring Cloud Gateway Server incorrectly forwards X-Forwarded-For and Forwarded headers from untrusted proxies in specific configurations.
The EventPrime plugin for WordPress contains an unauthenticated PHP object injection vulnerability, allowing remote attackers to execute arbitrary code.
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server allows an authenticated attacker to disclose sensitive information over the network.
An improper neutralization of input vulnerability (Cross-Site Scripting) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing attacks over a network.
On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters, allowing unauthorized data extraction.
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action.
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint.
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware allows potential remote command execution.
Spring AI Vector Stores are vulnerable to arbitrary query execution in Elasticsearch, OpenSearch, and GemFire via special character injection.
A signed integer overflow in the ASN1_mbstring_ncopy() function of the OpenSSL library can lead to a heap-based buffer overflow.
A stack-based buffer overflow in the Erlang OTP erts inet_drv component allows unauthenticated remote attackers to crash the BEAM VM via a crafted SCTP ERROR chunk.
Really Simple SSL versions 9 and below contain an unauthenticated broken authentication vulnerability, potentially allowing unauthorized access to the application.
A race condition in the Linux kernel's Intel VT-d implementation during PASID entry replacement could lead to memory corruption or system instability.
An OS command injection vulnerability in the ping diagnostic handler of Altice Labs GR140DG routers allows authenticated remote attackers to execute arbitrary commands as root.
An OS command injection vulnerability in the traceroute diagnostic handler of Altice Labs GR140DG routers allows authenticated remote attackers to execute arbitrary commands as root.
Software running as a non-privileged user can trigger an out-of-bounds write in the kernel via intentional GPU sparse memory API calls.
An unauthenticated broken access control vulnerability exists in the AI Product Search for WooCommerce plugin, allowing unauthorized access to restricted search functionalities.
The Hippoo Mobile App for WooCommerce version 1 and below contains an unauthenticated broken access control vulnerability, allowing unauthorized access to restricted functions.
WP Engine Faust.Js contains an authentication bypass vulnerability that allows unauthorized password recovery exploitation.
ThemeGrill Masteriyo - LMS contains an incorrect privilege assignment vulnerability that permits unauthorized privilege escalation.
A heap buffer overflow vulnerability in GStreamer's librfb client allows remote attackers to trigger code execution via a malicious VNC server.
The B Blocks plugin for WordPress contains a privilege escalation vulnerability that allows contributors to gain unauthorized control over the system.
The TMS Amelia Plugin for WordPress contains an incorrect privilege assignment vulnerability that allows subscribers to escalate their privileges.
A privilege escalation vulnerability exists in the Dokan plugin, allowing authenticated users with the Customer role to gain unauthorized elevated access.
A SQL injection vulnerability in PowerPress Podcasting allows authenticated users with the Contributor role to execute arbitrary SQL commands against the database.
A SQL injection vulnerability in MasterStudy LMS allows authenticated users with the Subscriber role to execute arbitrary SQL commands.
A SQL injection vulnerability in the GamiPress plugin allows authenticated users with the Subscriber role to execute arbitrary SQL commands.
A SQL injection vulnerability in the WP Time Slots Booking Form plugin allows authenticated users with the Subscriber role to execute arbitrary SQL commands.
A SQL injection vulnerability in Subscriber Taskbuilder allows authenticated attackers with subscriber-level access to execute arbitrary database queries.
A SQL injection vulnerability exists in the WCMultiShipping plugin, enabling authenticated subscribers to manipulate database queries.
An unauthenticated insecure deserialization vulnerability in Paid Videochat Turnkey Site allows attackers to execute arbitrary code.
An unauthenticated privilege escalation vulnerability in WP BASE Booking allows unauthorized users to gain elevated administrative permissions.
A CSV formula injection vulnerability in MIA Technology software allows attackers to execute arbitrary system commands when a malicious CSV file is opened.
A path traversal vulnerability exists in the WP Customer Area plugin, potentially allowing unauthorized access to sensitive files on the host server.
A mass assignment vulnerability in Flowise allows an authenticated user to take over custom templates belonging to other workspaces.
A security vulnerability exists within the Flowise drag-and-drop interface used for building customized large language model flows.
A security vulnerability exists within the Flowise drag-and-drop interface used for building customized large language model flows.
A security vulnerability exists within the Flowise drag-and-drop interface used for building customized large language model flows.
A security vulnerability in Config::IniFiles versions prior to 3 may allow for unauthorized manipulation or information disclosure within configuration files.
An unauthenticated arbitrary file deletion vulnerability exists in the Contact Form Extender for Divi plugin, allowing remote attackers to remove files from the server.
A guessable session cookie vulnerability in the GeoVision LPC2011/LPC2211 web interface allows unauthorized access to administrative sessions.
A vulnerability exists in the 'tmp' node package, which is used for creating temporary files and directories.
A security vulnerability has been identified in the Vim open-source command-line text editor.
A broken authentication vulnerability in the CloudSecure WP Security plugin allows unauthenticated attackers to bypass security controls.
A vulnerability in Adobe ColdFusion 2023 may expose the system to unauthorized access or remote code execution depending on the specific configuration.
A security flaw exists in Samba's certificate auto-enrollment Group Policy handling mechanism.