Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 19:17:42 +0000 CVE-2026-12583 — Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field https://cve.radiocsirt.org/vuln/cve-2026-12583 <p><strong>Affected:</strong> Unknown Newsletters</p> <p>The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.</p> <p><strong>Affected:</strong> Unknown Newsletters</p> <p>The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.</p> https://cve.radiocsirt.org/vuln/cve-2026-12583