CVE-2026-39770

Unauthenticated SQL Injection vulnerability in ARMember Premium versions up to 7.8. An attacker without authentication can manipulate database queries.

Unauthenticated SQL Injection vulnerability in Porto Theme - Functionality versions up to 3.9.3. An attacker can execute unauthorized database queries.

Unauthenticated SQL Injection vulnerability in Newsletter Subscription Form – User Subscriptions Form, Capture Email versions up to 1.5.9. An attacker can inject malicious SQL queries.

Unauthenticated PHP Object Injection vulnerability in GDPR Framework By Data443 versions up to 2.5.0. An attacker can inject malicious PHP objects, potentially leading to code execution.

Unauthenticated SQL Injection vulnerability in SendPress Newsletters versions up to 1.26.1.20. An attacker can perform unauthorized database operations.

Unauthenticated SQL Injection vulnerability in Gmedia Photo Gallery versions up to 1.25.1. An attacker can manipulate SQL queries without authentication.

Unauthenticated Privilege Escalation vulnerability in Doctreat Core versions up to 1.7.0. An attacker without authentication can gain elevated privileges.

Unauthenticated SQL Injection vulnerability in Radius Booking — Booking Calendar for Appointments & Services versions up to 1.0.19. An attacker can inject SQL queries.

Unauthenticated Privilege Escalation vulnerability in Meta Box AIO versions up to 3.7.1. An attacker without authentication can gain higher privileges.

The vulnerability allows an employer or sales representative to perform arbitrary file upload in Workreap Core up to version 3.4.5.