https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T12:20:40.096476+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-14558 CVE-2026-14558 — WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder 2026-10-07T12:20:40.112261+00:00

Affected: Unknown User Frontend

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.