By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 11 of 41

• CVE-2026-3297MEDIUM 6.4

  A vulnerability in the Pagelayer WordPress plugin allows users with contributor access or higher to inject malicious code into pages through the Anchor block feature. Because the plugin doesn't properly validate and escape user input, this injected code runs whenever anyone visits the affected page, potentially compromising site visitors or stealing their data.

• CVE-2026-34993MEDIUM 6.4

  AIOHTTP, a popular Python framework for asynchronous HTTP operations, contains a vulnerability in its CookieJar.load() function that could allow code execution when loading untrusted cookie data. The vulnerability exists in versions before 3.14.0. While the risk is moderate, it primarily affects applications that explicitly load cookie files from untrusted sources—a less common pattern than using CookieJar with application-generated data. Upgrading to version 3.14.0 or later eliminates the risk.

• CVE-2026-36612MEDIUM 6.4

  The Mercusys AC12G (EU) router with firmware version AC12G(EU)_V1_200909 ships with Wi-Fi Protected Setup (WPS) enabled by default. WPS is a feature designed to simplify device pairing, but this implementation has a critical weakness: after just 10 failed PIN guesses, the device locks out for only 60 seconds. This short lockout window makes brute-force attacks against the WPS PIN feasible within a reasonable timeframe, potentially allowing an attacker within wireless range to gain administrative access to the router.

• CVE-2026-3722MEDIUM 6.4

  A WordPress plugin called 'Auto Image Attributes From Filename With Bulk Updater' fails to properly clean and display user-supplied data in image metadata fields. This allows authenticated users with Author-level permissions or higher to embed malicious code into image properties. When site visitors view pages containing the injected image, that code runs in their browsers—potentially stealing session cookies, performing actions on their behalf, or redirecting them to malicious sites. The vulnerability affects all versions up to and including 4.9.

• CVE-2026-3907MEDIUM 6.4

  The Hostel WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its booking shortcode feature. An authenticated user with Contributor-level permissions or higher can inject malicious JavaScript code into a page by crafting a specially-formed shortcode. When other users visit that page, the injected script executes in their browsers, potentially allowing the attacker to steal session cookies, deface content, or redirect users to malicious sites. The vulnerability exists in all versions up to 1.1.7 and stems from the plugin failing to properly sanitize and escape user input before displaying it on the page.

• CVE-2026-39594MEDIUM 6.4

  A broken access control flaw in Ultra Addons for WPForms allows authenticated users to perform actions they shouldn't be permitted to perform, potentially modifying content or disrupting service for other users. The vulnerability affects versions up to and including 1.0.11. While an attacker needs a valid login, the impact extends across the broader WordPress installation, making this a medium-severity issue that requires prompt attention from site administrators running the affected plugin.

• CVE-2026-4080MEDIUM 6.4

  The Easy Cart plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'add_to_cart' shortcode. Attackers with Contributor-level access or above can inject malicious scripts into shortcode parameters that will execute for any user viewing the affected page. The vulnerability stems from incomplete sanitization—while HTML tags are stripped, quotation marks are not escaped, allowing attackers to break out of HTML attribute context and inject event handlers like onclick or onerror. All versions through 1.8 are affected.

• CVE-2026-4081MEDIUM 6.4

  The ZeM STL plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into website pages. When someone visits a page containing the injected script, their browser executes the attacker's code. This happens because the plugin doesn't properly clean or escape user input when processing shortcode parameters like 'url', 'color', and 'bgcolor'. All versions up to 1.0 are affected.

• CVE-2026-40985MEDIUM 6.4

  Spring Web Flow applications that use the WebFlowELExpressionParser are vulnerable to malicious Unified EL (Expression Language) expressions. An authenticated user with some social engineering (such as tricking a legitimate user into clicking a link or interacting with a crafted form) could inject harmful expressions into the application, potentially exposing sensitive data or modifying application state. The vulnerability requires user interaction and authenticated access, making it a moderate-risk issue for organizations running vulnerable Spring Web Flow versions.

• CVE-2026-41719MEDIUM 6.4

  Spring Data KeyValue and Spring Data Redis are widely used libraries for integrating key-value stores with Spring applications. A vulnerability in these libraries allows an attacker with authenticated access to inject malicious SpEL (Spring Expression Language) code through the Sort parameter of repository query methods. When the application passes unsanitized user input to sorting operations, the SpelPropertyComparator evaluates that input as executable code rather than treating it as data. This could allow an authenticated user to read sensitive data, modify application behavior, or degrade system availability.

• CVE-2026-41982MEDIUM 6.4

  CVE-2026-41982 is a race condition vulnerability affecting the IPC (inter-process communication) module. An authenticated attacker can exploit this flaw to degrade system availability. The vulnerability requires specific conditions to trigger and is rated MEDIUM severity with a CVSS score of 6.4.

• CVE-2026-4328MEDIUM 6.4

  The Advanced Import plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated users with Author-level permissions or higher to make web requests from the vulnerable server to arbitrary internal or external locations. An attacker can exploit this by supplying a specially crafted URL through the plugin's demo file import feature, enabling them to access sensitive data from cloud metadata endpoints, internal databases, or other restricted services on the organization's network. The vulnerability stems from incomplete input validation—the plugin sanitizes only for XSS threats but fails to prevent requests to private network resources, despite using safer alternatives elsewhere in the codebase.

• CVE-2026-4334MEDIUM 6.4

  The Shariff Wrapper plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.6.20. Attackers with Contributor-level access or higher can inject malicious scripts through the 'headline' parameter in the [shariff] shortcode. When other users view the affected page, the injected code executes in their browsers, potentially enabling session hijacking, credential theft, or further compromise. The vulnerability stems from the plugin's use of a permissive HTML sanitization routine followed by unsafe string replacement operations that reintroduce dangerous content after the sanitization check.

• CVE-2026-44462MEDIUM 6.4

  Zed is a popular code editor that includes a terminal tool with permission controls meant to restrict which commands can be executed. Prior to version 0.229.0, an attacker could bypass these restrictions by chaining bash variable expansion syntax—specifically the ${var@P} expansion—to execute arbitrary commands even when they appeared to violate the allowed command prefix rules. This requires user interaction (opening a malicious project or terminal configuration) but grants the attacker code execution within the editor's process context.

• CVE-2026-45285MEDIUM 6.4

  Nextcloud inadvertently creates hidden public links when users share folders or files with Teams that include external members (people invited via email without Nextcloud accounts). These links remain invisible in the sharing interface but are emailed to the external recipient and grant full permissions—read, write, delete, reshare, download. An attacker intercepting or receiving one of these links gains unfettered access to all shared data without authentication, and the folder owner cannot see or revoke the link through normal UI controls. Versions 32.0.0–32.0.8 and 33.0.0–33.0.2 are vulnerable; patches are available.

• CVE-2026-4610MEDIUM 6.4

  The ProfileGrid plugin for WordPress, used for managing user profiles and community features, contains a security flaw that allows authenticated users (those with Subscriber level access or higher) to inject malicious scripts into pages. When other users visit those affected pages, the injected scripts execute in their browsers, potentially compromising their sessions or stealing data. The vulnerability affects all versions up to 5.9.9.2, though a partial fix was introduced in version 5.9.8.5.

• CVE-2026-4653MEDIUM 6.4

  The Block, Suspend, Report for BuddyPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows any logged-in user with subscriber access or higher to inject malicious scripts into the plugin's pages. When other users visit those pages, the injected scripts execute in their browsers, potentially allowing attackers to steal session cookies, deface content, or perform actions on behalf of victims. The vulnerability exists in versions 3.6.4 and earlier due to the plugin failing to properly filter the 'link' parameter before displaying it.

• CVE-2026-47268MEDIUM 6.4

  Nezha Monitoring, a self-hosted server and website monitoring tool, contains a vulnerability in its DDNS (Dynamic DNS) webhook feature. An authenticated user with low privileges can configure a malicious webhook URL that the dashboard will call whenever DDNS is triggered. Because these webhook requests bypass the safety checks normally applied to internal requests, an attacker can make the dashboard server connect to internal services or loopback addresses on the dashboard host itself. While the attacker cannot directly see the responses from these internal services, they can still issue commands that change state or probe for vulnerabilities. This requires an authenticated account and a server under the attacker's control, but the impact could include unauthorized access to internal monitoring endpoints or other backend services.

• CVE-2026-4804MEDIUM 6.4

  The Zakra WordPress theme contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.2.0. An authenticated user with basic contributor permissions can inject malicious JavaScript into specific theme settings that gets saved and executed whenever anyone views the affected page. The vulnerability exists because the theme fails to validate user input through its REST API, even though it does sanitize input from the classic editor. This allows attackers to compromise visitor sessions and steal data without needing to exploit any other systems.

• CVE-2026-48167MEDIUM 6.4

  Filament, a popular Laravel development framework, contains a stored cross-site scripting (XSS) vulnerability in its ImageColumn and ImageEntry components. These components display database images without sanitizing the underlying data, allowing an attacker to inject malicious HTML or JavaScript. If an attacker can control the image data stored in the database—typically through an application feature that accepts user uploads or metadata—the injected code executes when other users view the affected table or schema. This is a persistence risk: the attack payload stays in the database and impacts every user who accesses that view.

• CVE-2026-50014MEDIUM 6.4

  pnpm, a widely-used Node.js package manager, contains a command-injection vulnerability in how it processes git repository references. When pnpm resolves dependencies from git sources, it reads commit hashes from the project's lockfile. A malicious lockfile can inject git command-line options (like `--upload-pack`) in place of a legitimate commit hash. For projects using SSH or local git repositories, this allows an attacker to execute arbitrary commands during dependency installation. HTTPS-based git dependencies are not affected because the git client ignores the malicious option in that context. The vulnerability requires an attacker to control or modify the lockfile and a user to install dependencies, making it a supply-chain vector rather than a network-direct attack.

• CVE-2026-50592MEDIUM 6.4

  Znuny, a widely-used open-source helpdesk and ticketing platform, contains a reflected cross-site scripting (XSS) vulnerability in its administrative communication log interface. An authenticated attacker with login credentials can craft a malicious URL containing injected JavaScript that executes in the browser of another administrator viewing the communication logs. This could allow credential theft, session hijacking, or other actions performed on behalf of the compromised administrator. The vulnerability affects Znuny LTS versions before 6.5.21 and Znuny versions before 7.3.3.

• CVE-2026-5220MEDIUM 6.4

  DivvyDrive, a file collaboration and sharing platform by DivvyDrive Information Technologies Inc., contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the application. When other users access pages containing this injected content, the malicious code executes in their browsers, potentially allowing attackers to steal session tokens, modify data, or perform actions on behalf of victims. The vulnerability affects versions 4.8.2.23 through 4.8.3.0; version 4.8.3.1 and later resolve the issue.

• CVE-2026-52781MEDIUM 6.4

  OpenProject, a popular open-source project management platform, contains a vulnerability in how it sanitizes HTML content in work package descriptions. An attacker with login credentials can inject malicious code that exploits Stimulus.js, a JavaScript framework, to automatically execute commands in the browsers of other authenticated users. This could redirect victims to phishing sites or other attacker-controlled locations without their knowledge. The flaw affects all versions before 17.3.3 and 17.4.1.

• CVE-2026-53521MEDIUM 6.4

  Nezha Monitoring, a lightweight self-hosted server monitoring tool, contains a flaw in versions 2.0.14 through 2.0.x that allows attackers to hijack DDNS (Dynamic DNS) profile updates. An authenticated user can save references to nonexistent DDNS profiles on their server. Later, if another user creates a DDNS profile matching one of those IDs, the monitoring system will incorrectly use the new user's DDNS configuration to push updates to the attacker's infrastructure. This creates a cross-user context confusion where DDNS changes intended for one user leak into another user's server configuration. The issue is resolved in version 2.1.0.

• CVE-2026-53987MEDIUM 6.4

  A vulnerability in the Tag plugin for GLPI 11 allows authenticated users with tag management privileges to inject malicious HTML code into tag names. Because the plugin fails to sanitize tag names when storing them and doesn't escape output when displaying tags in Kanban views, the injected code executes in the browsers of any user viewing tickets, problems, changes, or projects that use those tags. This is a stored cross-site scripting (XSS) vulnerability that persists until the malicious tag is removed.

• CVE-2026-54015MEDIUM 6.4

  Open WebUI, a self-hosted AI platform, contains a vulnerability in how it manages access to saved prompt versions and history. Before version 0.9.6, the application checks that you own a prompt before letting you view its history, but fails to verify that individual history entries actually belong to that prompt. An attacker with legitimate access to any prompt they control can exploit this flaw to read or delete the saved version history of other users' private prompts, provided they can discover a history entry ID. The vulnerability requires authentication and knowledge of specific history entry identifiers, limiting its practical reach but making it a serious concern for multi-user deployments.

• CVE-2026-54306MEDIUM 6.4

  n8n, a popular open-source workflow automation platform, contains a prototype pollution vulnerability that allows attackers to inject malicious data through public webhooks. If a workflow accepts external webhook input and uses that data in action nodes—such as updating records or making API calls—an attacker can manipulate those downstream actions by poisoning the data stream. The attacker essentially tricks the workflow into performing unintended operations, like modifying the wrong records or sending requests using the workflow owner's credentials. This flaw affects versions before 2.25.7 and 2.26.2.

• CVE-2026-56306MEDIUM 6.4

  Capgo versions before 12.128.2 contain a flaw in how they validate a specific HTTP header used to enforce restricted API key permissions. An authenticated attacker can craft malformed, zero, or duplicate values in the x-limited-key-id header to trick the system into ignoring subkey restrictions. Once the restriction is bypassed, the attacker's request runs with the privileges of the main API key instead of the intended limited subkey, potentially granting broader access than intended.

• CVE-2026-56329MEDIUM 6.4

  Capgo versions before 12.128.2 have a namespace collision vulnerability in how preview URLs are parsed. The system decodes double underscores to dots in a way that isn't unique—meaning an attacker can register an app ID with underscores that collides with another tenant's dotted app ID. This causes preview traffic to be misrouted and can deny legitimate users access to their preview environments.

• CVE-2026-56778MEDIUM 6.4

  n8n, a popular workflow automation platform, contains a flaw in its Public API that allows users with read-only access to workflows to trigger re-executions of those workflows. The vulnerability stems from an authorization check that uses the wrong permission scope—it verifies read access when it should verify execute access. This means an authenticated user who should only be able to view a shared workflow can actually run it again, circumventing the intended separation between viewing and executing. The issue affects n8n versions before 2.25.7 and 2.26.x before 2.26.2, particularly in multi-user or cross-project setups where workflows are shared.

• CVE-2026-56779MEDIUM 6.4

  MaxKB versions before 2.10.0 contain a server-side request forgery (SSRF) flaw in their tool management features. An authenticated user with standard workspace permissions can craft malicious requests to make the MaxKB server itself fetch data from internal network locations they specify. This breaks the assumption that authenticated users can only interact with external resources through normal channels, effectively turning the MaxKB server into a proxy for attacking systems behind firewalls or accessing sensitive internal services.

• CVE-2026-5714MEDIUM 6.4

  The Enable Media Replace plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Author-level permissions or higher to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially compromising their accounts, stealing session data, or performing actions on their behalf. The vulnerability exists in all versions up to and including 4.1.8 and results from the plugin's failure to properly sanitize and escape the 'location_dir' parameter.

• CVE-2026-57956MEDIUM 6.4

  SigNoz versions before 0.133.0 contain a flaw in how they enforce access controls for alert rules in multi-tenant deployments. An authenticated user in one organization can view, modify, and delete alert rules belonging to a completely different organization by directly referencing the rule's UUID. This happens because the system fails to verify that the requesting user's organization actually owns the rule before granting access. The vulnerability requires valid login credentials to exploit but does not require special privileges, making it a significant tenant isolation issue.

• CVE-2026-6062MEDIUM 6.4

  Mattermost Server contains an authorization flaw that allows authenticated users to modify notification subscriptions for channels they don't have access to. An attacker with any valid Mattermost account can craft a specially formed request to edit subscription settings on channels outside their permissions, potentially redirecting notifications or modifying channel monitoring rules. The vulnerability affects multiple versions across the 10.11, 11.5, 11.6, and 11.7 release lines and requires an attacker to already have valid authentication credentials to the Mattermost instance.

• CVE-2026-6275MEDIUM 6.4

  The StatCounter – Free Real Time Visitor Stats WordPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated authors to inject malicious scripts into their posts. When any visitor views a post authored by an attacker, the injected script executes in their browser. The vulnerability exists because the plugin fails to properly escape the author's nickname before outputting it into JavaScript code on every post page.

• CVE-2026-6427MEDIUM 6.4

  The a3 Lazy Load WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions through 2.7.6. An attacker with Contributor-level permissions can craft a malicious video element that exploits a regex parsing bug in the plugin's video filtering logic. When this crafted content is viewed by any site user—including administrators—malicious JavaScript executes in their browser. The vulnerability stems from improper quote handling in HTML attribute processing, combined with unescaped output in the admin interface.

• CVE-2026-6459MEDIUM 6.4

  A WordPress plugin called Essential Addons for Elementor has a security flaw in its Event Calendar widget that allows content creators and administrators to inject malicious code into web pages. When visitors view those pages, the injected code runs in their browsers, potentially allowing attackers to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability exists because the plugin doesn't properly clean or escape event titles pulled from The Events Calendar. Only users with Author-level permissions or higher can exploit this, so it requires insider access or a compromised legitimate account.

• CVE-2026-6673MEDIUM 6.4

  Mattermost is vulnerable to an authentication bypass in how it handles Atlassian Connect integration callbacks. During the window when a Jira integration is being installed, an attacker with valid Mattermost user credentials can craft a malicious POST request to trick the system into accepting a fake shared secret. This compromises the trust relationship between Mattermost and Jira, allowing disruption of the integration and potentially enabling further attacks. The vulnerability affects multiple versions across the 10.11, 11.5, 11.6, and 11.7 release lines.

• CVE-2026-6740MEDIUM 6.4

  The Nexter Blocks plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'commentIcon' parameter that affects all versions through 4.7.4. An authenticated attacker with contributor-level or higher permissions can inject malicious JavaScript code that persists in page content. When any user visits an affected page, the injected script executes in their browser, potentially compromising their session, stealing credentials, or performing unauthorized actions on their behalf.

• CVE-2026-6742MEDIUM 6.4

  The Advanced iFrame plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'additional' parameter that allows authenticated users with contributor-level permissions or higher to inject malicious scripts into pages. When other users view those pages, the injected code executes in their browsers, potentially compromising data or sessions. The vulnerability affects all versions up to and including 2026.1 and stems from inadequate input validation and output encoding.

• CVE-2026-6910MEDIUM 6.4

  The Bookero.pl online reservation system plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 2.2. An authenticated user with contributor privileges or higher can embed malicious JavaScript code into pages using the plugin's shortcode attributes. When other users visit those pages, the injected script executes in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability exists because the plugin fails to properly sanitize and escape user input before embedding it directly into JavaScript code.

• CVE-2026-7662MEDIUM 6.4

  The ePaperFlip Publisher plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into pages. When other users view those pages, the injected scripts execute in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability affects all versions up to and including version 1 and stems from the plugin failing to properly filter and escape user input in the 'publicationid' shortcode attribute before inserting it into JavaScript code.

• CVE-2026-7795MEDIUM 6.4

  The Click to Chat – WA Widget plugin for WordPress contains a flaw that allows authenticated users with basic contributor permissions to inject malicious code into pages. When someone clicks the WhatsApp chat button on an affected site, the injected code executes in their browser. The vulnerability stems from improper handling of a shortcode parameter: the plugin escapes user input in a way that works for HTML attributes, but that escaping is later decoded by browsers when the value appears inside a JavaScript function call within an event handler. This creates a window for attackers to break out of the intended string context and run arbitrary JavaScript.

• CVE-2026-7796MEDIUM 6.4

  The EmbedPress WordPress plugin, used for embedding PDFs, videos, and other rich media content, contains a stored cross-site scripting (XSS) vulnerability that allows attackers with contributor-level access to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially allowing attackers to steal credentials, perform unauthorized actions, or compromise user sessions. This affects all versions up to and including 4.5.3.

• CVE-2026-8039MEDIUM 6.4

  The Fancy Testimonials plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in how it handles the 'author' attribute of the testimonial shortcode. An authenticated user with Contributor-level permissions or higher can insert malicious JavaScript into a page through this attribute. That script then executes in the browsers of anyone who visits the affected page. Because the malicious code is permanently stored in the page content, every visitor becomes a potential victim—making this a stored XSS rather than a one-time reflected attack.

• CVE-2026-8351MEDIUM 6.4

  The RTMKit plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its Advanced Heading widget. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript into the 'Background Text' parameter, which gets saved to the database and executes whenever any site visitor loads the affected page. This is a persistence risk because the payload remains embedded in your content until manually removed.

• CVE-2026-8489MEDIUM 6.4

  The Ultimate Member WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its user profile 'about_me' field. Authenticated users with subscriber-level permissions can inject malicious JavaScript code that persists in the database and executes in the browsers of anyone viewing the affected profile or related pages. This is a stored variant, meaning the attack payload remains active until manually removed, creating ongoing exposure for site visitors.

• CVE-2026-8494MEDIUM 6.4

  Permalink Manager Lite, a WordPress plugin, contains a security flaw in its admin interface that allows contributors and higher-level users to embed malicious scripts into post titles. When an administrator later visits the Permalink Manager page, that script executes in their browser. The vulnerability exists in all versions up to 2.5.3.3 and requires an authenticated attacker with at least contributor privileges to exploit.

• CVE-2026-8599MEDIUM 6.4

  MailerPress, a popular WordPress plugin for email marketing and automation, contains a vulnerability that allows attackers with author-level or higher permissions to inject malicious scripts into campaign content. These scripts execute when administrators preview the campaigns in the WordPress dashboard. The vulnerability stems from the plugin not properly filtering user input when storing campaign HTML, nor adequately escaping that content when displaying it. The public-facing preview that customers see is protected by security headers, so the risk is primarily to the WordPress site's admin users rather than to recipients of sent emails.

• CVE-2026-8607MEDIUM 6.4

  The myCred WordPress plugin, used for managing loyalty points, badges, and gamification features, contains a stored cross-site scripting (XSS) vulnerability in its shortcode functionality. An attacker with contributor-level or higher access to WordPress can craft malicious code within a shortcode attribute that will execute in the browsers of all users who visit the affected page. This is a persistent attack—the malicious script remains embedded in the site until removed—rather than a one-time exploitation attempt.

• CVE-2026-8613MEDIUM 6.4

  The aThemes Addons for Elementor plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in multiple widget components. A WordPress contributor or higher-privilege user can inject malicious JavaScript into page settings that will execute in the browsers of any visitor to that page. The vulnerability exists in the Posts Timeline widget and Posts Carousel widget (across its default, Banner, and Modern variants) due to missing input validation on the 'title_tag' setting. The same plugin's Posts List widget correctly implements this validation, indicating the flaw is inconsistently applied across the codebase.

• CVE-2026-8649MEDIUM 6.4

  Progress MOVEit Transfer contains a vulnerability in its Custom Reports module that allows an authenticated user with administrative privileges to inject malicious input into report queries. By crafting specially designed data, an attacker can manipulate how the application processes database queries, potentially leading to unauthorized access to sensitive information or modification of report data. The vulnerability requires high user privileges and interaction to exploit, making it a moderate-risk issue primarily relevant to organizations where administrator accounts may be compromised or where insider threats exist.

• CVE-2026-8677MEDIUM 6.4

  Prime Elementor Addons, a WordPress plugin for building pages with Elementor, has a stored cross-site scripting (XSS) vulnerability that allows contributors and higher-privileged users to inject malicious scripts into pages. When other users view those pages, the injected scripts execute in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability persists through versions up to 1.3.3 because the plugin fails to properly sanitize widget HTML settings before storing them.

• CVE-2026-8841MEDIUM 6.4

  The Extra Settings for RocketChat plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 0.1. A WordPress user with contributor-level permissions or higher can craft a malicious 'title' attribute in the 'rocketchat' shortcode to inject JavaScript code into a page. When other users visit that page, the injected script executes in their browser within the site's context, potentially allowing the attacker to steal credentials, perform actions on their behalf, or deface content.

• CVE-2026-8865MEDIUM 6.4

  The Avalon23 Products Filter for WooCommerce plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated WordPress contributors and higher-privileged users to inject malicious JavaScript into pages via the 'avalon23_qr' shortcode. When other users visit an affected page, the injected script executes in their browsers, potentially compromising their accounts or stealing sensitive data. The vulnerability exists because the plugin fails to properly sanitize and escape user input in shortcode attributes before displaying them in HTML.

• CVE-2026-8880MEDIUM 6.4

  The RomanCart Ecommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its shortcode handler. An authenticated user with contributor permissions or higher can inject malicious JavaScript code into pages through the romancart_button shortcode's attributes. Once injected, that code executes for every visitor who views the affected page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability exists in versions 2.0.8 and earlier due to inadequate input validation and output encoding.

• CVE-2026-8882MEDIUM 6.4

  A WordPress plugin called WP ApplicantStack Jobs Display contains a security flaw that allows certain logged-in users to inject malicious code into web pages. When other users visit those pages, the injected code runs in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability affects all versions up to and including 1.1.1 and requires the attacker to have at least contributor-level permissions on the WordPress site.

• CVE-2026-8883MEDIUM 6.4

  The Global Body Mass Index Calculator WordPress plugin contains a stored cross-site scripting (XSS) flaw affecting versions 1.2 and earlier. Attackers with contributor-level access can inject malicious scripts through the plugin's shortcode functionality. These scripts persist in the database and execute whenever site visitors view affected pages, potentially compromising user sessions, stealing credentials, or spreading malware across your WordPress site.

• CVE-2026-8885MEDIUM 6.4

  The DeMomentSomTres Shortcodes plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'callout' shortcode feature. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code through the 'width' and 'align' shortcode parameters. Because the plugin fails to properly sanitize and escape these inputs, the injected code executes whenever any visitor views the affected page. This creates a persistent threat that compromises site visitors, not just the page editor.

• CVE-2026-8892MEDIUM 6.4

  The CM Business Directory plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated contributors to inject malicious code into business address fields. Unlike typical WordPress vulnerabilities, this flaw bypasses the standard HTML filtering mechanism because the malicious payload is stored in metadata rather than post content. Once injected, the script executes whenever anyone views pages displaying that business directory data, potentially affecting site visitors and administrators.

• CVE-2026-8893MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in the Express Payment For Stripe WordPress plugin up to version 1.28.0. Authenticated users with contributor-level permissions or higher can embed malicious scripts into pages using the [stripe-express] shortcode. These scripts execute in the browsers of anyone viewing the affected page, potentially allowing attackers to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability stems from the plugin failing to properly escape shortcode attribute values before rendering them in HTML.

• CVE-2026-8895MEDIUM 6.4

  A WordPress plugin called 'kk blog card' contains a security flaw that allows contributors and higher-level users to embed malicious scripts into pages. When someone visits a page with the injected code, the script runs automatically in their browser. The vulnerability exists in versions 1.3 and earlier, and stems from the plugin not properly filtering user input before inserting it into HTML code.

• CVE-2026-8896MEDIUM 6.4

  The MIR blocks and shortcodes WordPress plugin contains a vulnerability that allows authenticated users with contributor-level permissions or higher to embed malicious code into pages. When someone visits an affected page, that malicious code runs in their browser. The vulnerability exists because the plugin doesn't properly clean user input in its 'msc_stats' shortcode—specifically in the 'title' and 'ready_animation_text' attributes. While this requires an attacker to already have login access to WordPress, it's a serious risk for multi-user sites or those with guest contributor roles.

• CVE-2026-8900MEDIUM 6.4

  The Simple SEO Slideshow WordPress plugin has a security flaw that allows authenticated users with contributor-level permissions or higher to inject malicious scripts into pages. When someone visits a page containing this injected code, the script executes in their browser—including for administrators. The vulnerability exists because the plugin does not properly filter user input when processing shortcode attributes, even though WordPress has built-in protections that should catch this. All versions through 1.2.8 are affected.

• CVE-2026-8977MEDIUM 6.4

  The WP GDPR Cookie Consent plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with subscriber-level permissions or higher to inject malicious JavaScript code into website pages. When other users visit an affected page, the injected script executes in their browsers, potentially allowing attackers to steal session tokens, redirect visitors, inject malware, or perform other actions on behalf of legitimate users. The vulnerability exists because the plugin fails to properly validate user input and safely display stored configuration settings.

• CVE-2026-9019MEDIUM 6.4

  The Easy Image Collage plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.13.6. Attackers with author-level access or higher can inject malicious scripts into posts or pages through image collage settings. When other users view these pages, the injected scripts execute in their browsers, potentially stealing credentials, redirecting traffic, or performing actions on their behalf. The vulnerability persists because the plugin stores user input in post metadata without proper sanitization, bypassing WordPress's standard HTML restriction controls that normally protect against this type of attack.

• CVE-2026-9107MEDIUM 6.4

  Kali Forms, a popular WordPress form-building plugin, contains a vulnerability that allows users with contributor-level permissions (or higher) to inject malicious code into pages. When other users view those pages, the injected code runs in their browsers. This affects all versions through 2.4.13. The vulnerability stems from the plugin's failure to properly clean and escape data in the 'kaliforms_field_components' parameter, a common weakness in web applications handling user input.

• CVE-2026-9125MEDIUM 6.4

  A stored cross-site scripting (XSS) flaw exists in the Presto Player WordPress plugin affecting versions up to 4.2.0. An authenticated user with contributor-level permissions can inject malicious JavaScript code into pages by manipulating the 'link_url' parameter in the [presto_player_overlay] shortcode. Unlike reflected XSS attacks that require tricking users into clicking a link, this vulnerability persists in the database, meaning any visitor to an affected page will automatically execute the attacker's script without additional interaction. The attack relies on the plugin failing to properly validate that URLs only use safe schemes (like 'http' or 'https'), allowing attackers to sneak in 'javascript:' URIs that execute when users click overlay elements.

• CVE-2026-9134MEDIUM 6.4

  The FooGallery WordPress plugin contains a vulnerability that allows contributors and higher-privileged users to inject malicious JavaScript code into pages. The plugin's sanitization function blocks only some HTML event handlers (like onclick and onload) but misses others like onmouseenter. When a visitor views an affected page, the injected script runs in their browser without their knowledge, potentially compromising their session or stealing information.

• CVE-2026-9243MEDIUM 6.4

  The Plus Addons for Elementor plugin contains a flaw that allows authenticated WordPress users with contributor-level permissions or higher to inject malicious scripts into website pages. When a victim visits an affected page, the injected script executes in their browser, potentially compromising their session or stealing data. The vulnerability exists in the Carousel Anything widget's handling of the carousel_direction parameter and affects versions up to 6.4.15.

• CVE-2026-9281MEDIUM 6.4

  Master Addons For Elementor, a popular WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with author-level permissions to inject malicious scripts into pages. The vulnerability exists in the Custom JS Extension feature and affects all versions up to 3.1.0. Because the injected scripts persist in the database and execute whenever visitors view the affected pages, this could be used to steal credentials, distribute malware, or redirect users to phishing sites. The core issue is that the plugin fails to properly validate and sanitize user input when saving custom JavaScript code, and the security checks that exist only apply to the visual editor interface, not to direct API calls.

• CVE-2026-9557MEDIUM 6.4

  Mautic's Focus component contains a Server-Side Request Forgery (SSRF) flaw that allows authenticated users to manipulate the application into making HTTP requests on their behalf. An attacker with valid credentials can craft specially-formed URLs to probe the internal network, access services that should only be reachable from within the organization, or force the server to make requests to external systems. The vulnerability requires authentication, which limits the immediate attack surface but still poses a meaningful risk to organizations where user accounts are shared, compromised, or granted to untrusted users.

• CVE-2026-9620MEDIUM 6.4

  The WP Latest Posts WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to 5.0.11. An authenticated attacker with author-level permissions can inject malicious scripts into post content by crafting image tags with specially formatted src attributes. Because the plugin fails to properly escape these values before displaying them, the injected scripts execute in the browsers of any visitor viewing the compromised post. This is a stored attack, meaning the payload persists in the database and affects all subsequent viewers.

• CVE-2026-9626MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in the JSON API User plugin for WordPress affecting versions up to 4.1.0. An authenticated attacker with subscriber-level access can inject malicious scripts into post comments through the REST API's post_comment endpoint. Because the injected content bypasses moderation and is stored permanently, the malicious code executes automatically when other users view the affected page—making this a persistent threat that could compromise visitor sessions or steal sensitive information.

• CVE-2026-9629MEDIUM 6.4

  The Canvas plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its tag parameter that allows contributors and above to inject malicious scripts into pages. When other users view those pages, the injected scripts execute in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability affects all versions up to and including 2.5.2 and requires an authenticated account with at least contributor-level permissions to exploit.

• CVE-2026-9644MEDIUM 6.4

  A WordPress plugin called LiveSmart Video Chat has a security weakness that allows authenticated users with contributor-level permissions to inject malicious code into pages. When other visitors view those pages, the injected code runs in their browsers, potentially compromising their accounts or data. The vulnerability exists in all versions up to 1.2 and stems from the plugin not properly filtering user input before displaying it on pages.

• CVE-2026-9714MEDIUM 6.4

  A vulnerability in the Simple Divi Shortcode WordPress plugin (versions 1.2 and earlier) allows authenticated users with contributor-level permissions or higher to inject malicious code into pages. When other users view those pages, the injected code executes in their browsers. The vulnerability stems from the plugin failing to properly sanitize user input in the [showmodule] shortcode's 'id' parameter. While this requires authenticated access, the ability to execute arbitrary scripts across users' sessions creates a meaningful security risk for WordPress sites using this plugin.

• CVE-2026-9756MEDIUM 6.4

  The GenerateBlocks WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its Headline Block feature. An authenticated contributor can inject malicious JavaScript that persists in the database and executes whenever any site visitor—including administrators—views an affected page. The attack works by storing a JavaScript payload in the attacker's user profile, then using the plugin's 'linkMetaFieldType' attribute to create a link that triggers the malicious code. This affects all versions up to and including 2.2.1.

• CVE-2025-10262MEDIUM 6.3

  CVE-2025-10262 is a local privilege escalation flaw in Nokia SR Linux that stems from improper validation of format strings. An authenticated user with limited privileges can exploit this weakness to gain superuser-level command execution on the device. The vulnerability requires local access and cannot be exploited remotely, but once triggered, it grants full system control.

• CVE-2025-65640MEDIUM 6.3

  Arket Globe Document Intelligence version 5.0.0.559 contains a reflected cross-site scripting (XSS) vulnerability in the "Task in Progress / Recent" page. An authenticated attacker can inject malicious JavaScript into document creation fields that will execute in the browsers of other users viewing that page, potentially allowing session hijacking, credential theft, or other malicious actions performed on behalf of those users.

• CVE-2025-70102MEDIUM 6.3

  dhcpcd 10.3.0 contains a crash vulnerability triggered when parsing malformed or unexpected configuration options. The vulnerable code attempts to access properties of a data structure without first verifying it exists, causing the application to crash. This affects systems that use dhcpcd for DHCP configuration, particularly in automated environments or where untrusted configuration input is processed.

• CVE-2025-9912MEDIUM 6.3

  CVE-2025-9912 is a local privilege escalation flaw in Nokia SR Linux that allows an authenticated user with elevated privileges to execute arbitrary commands as root. The vulnerability requires local access and existing authentication—an insider or someone already on the system—but once triggered, can grant complete system control. This is not a remote attack vector; however, it does transform limited user accounts into fully privileged ones.

• CVE-2026-10060MEDIUM 6.3

  TRENDnet's TEW-432BRP wireless router (firmware version 3.10B20) contains a command injection vulnerability in its route configuration interface. An authenticated attacker can manipulate IP, mask, or gateway parameters to inject arbitrary commands on the device. The vulnerability requires valid credentials but poses a direct threat to affected networks. Critically, this product reached end-of-life in 2009—over 15 years ago—and the vendor has stated it cannot replicate or fix vulnerabilities in legacy hardware.

• CVE-2026-10061MEDIUM 6.3

  A command injection vulnerability exists in the TRENDnet TEW-432BRP wireless router (firmware version 3.10B20), discovered in the WPS configuration function. An authenticated attacker can manipulate the peerPin parameter to execute arbitrary commands on the device. The vulnerability is network-accessible and requires valid login credentials. Notably, this router reached end-of-life in 2009—over 15 years ago—and TRENDnet has stated they cannot replicate or provide fixes for vulnerabilities in this legacy hardware. While exploit code is public, the practical risk is limited to organizations still operating this obsolete equipment in production environments.

• CVE-2026-10064MEDIUM 6.3

  TRENDnet has disclosed a remote stack-based buffer overflow vulnerability in the TEW-432BRP wireless router (firmware version 3.10B20 and earlier). An authenticated attacker can exploit this flaw by sending a specially crafted request to the port forwarding configuration endpoint, potentially allowing code execution or denial of service. The vendor has confirmed this product reached end-of-life in 2009 and will not issue patches. Public exploit code is available, elevating the practical risk despite the device's age.

• CVE-2026-10101MEDIUM 6.3

  ACM/MCE (Advanced Cluster Management / Multicluster Engine) inadvertently exposes container registry credentials in InfraEnv status messages when pull-secret validation fails. A user with read-only namespace access can view InfraEnv objects and extract the full `.dockerconfigjson` payload—including usernames, passwords, and base64-encoded authentication tokens—despite having no direct permission to read Secrets. This circumvents Kubernetes RBAC controls designed to keep registry credentials confidential.

• CVE-2026-10127MEDIUM 6.3

  A command injection vulnerability exists in Edimax BR-6478AC wireless routers running firmware version 1.23. An authenticated attacker can send a specially crafted web request to the device's configuration interface that tricks it into executing arbitrary system commands. The vulnerability stems from improper validation of the 'rootAPmac' parameter in the device's wireless driver setup function. Because proof-of-concept code has been publicly released, there is a meaningful risk that attackers will attempt to exploit this flaw in active environments.

• CVE-2026-10152MEDIUM 6.3

  A flaw in TaleLin's lin-cms-spring-boot framework (version 0.2.1 and earlier) allows authenticated users to bypass access controls on the book endpoint. An attacker with valid login credentials can manipulate requests to perform actions they should not be permitted to execute, such as viewing, modifying, or deleting book records without proper authorization checks. Proof-of-concept code is publicly available, increasing the risk of active exploitation.

• CVE-2026-10166MEDIUM 6.3

  A command injection vulnerability exists in Edimax BR-6478AC version 1.23 that allows an authenticated attacker to execute arbitrary commands on the device. The flaw is in the web interface's wireless settings handler, where the rootAPmac parameter is not properly sanitized before being used in system commands. An attacker with valid login credentials can manipulate this parameter to inject malicious commands, potentially compromising router configuration, data, or availability. Public exploit details are available, increasing real-world risk.

• CVE-2026-10168MEDIUM 6.3

  A vulnerability in OUSL-GROUP-BrinaryBrains School Student Management System allows authenticated users to manipulate resource identifiers through the marks function in the Parents.php controller, potentially exposing or modifying student data. An attacker with login credentials can exploit this remotely by injecting malicious parameters, affecting the confidentiality and integrity of educational records. Public disclosure has occurred, increasing real-world exploitation risk.

• CVE-2026-10170MEDIUM 6.3

  A SQL injection vulnerability exists in code-projects Visitor Management System version 1.0. An authenticated attacker can manipulate the 'phone' parameter in the /vms/php/phone_0.php file to inject malicious SQL commands. This allows the attacker to read, modify, or delete database contents without special privileges. The vulnerability requires valid login credentials to exploit and has a published proof-of-concept.

• CVE-2026-10172MEDIUM 6.3

  Bdtask Multi-Store Inventory Management System version 1.0 contains a file upload vulnerability that allows authenticated users to upload arbitrary files to the server without validation. An attacker with valid login credentials can exploit this flaw to upload malicious files, potentially leading to remote code execution or other attacks. Public exploit code is available, increasing the risk of widespread exploitation.

• CVE-2026-10174MEDIUM 6.3

  Aider-AI's Aider version 0.86.3 contains a flaw in how it processes pre-commit hook arguments. An attacker with valid credentials can manipulate the git-commit-verify argument to bypass security protections that normally prevent unauthorized code commits. The vulnerability requires network access and prior authentication, making it a concern primarily for development teams using Aider in shared or untrusted environments. Public exploit code exists, increasing the practical risk.

• CVE-2026-10175MEDIUM 6.3

  A code injection vulnerability exists in Aider-AI Aider version 0.86.3 within the Architect Mode feature. An authenticated user can manipulate the editor_coder.run function in auth.py to inject and execute arbitrary code on the system. The flaw requires valid credentials to exploit but no additional user interaction, making it a direct threat to organizations using this development assistance tool. Public exploit code is already available.

• CVE-2026-10176MEDIUM 6.3

  Aider-AI's Aider version 0.86.3 contains a SQL injection vulnerability in its code generation workflow that can be exploited by authenticated users to manipulate database queries. While the vulnerability requires login credentials to trigger, an attacker with access can extract, modify, or delete sensitive data. Public exploit information is available, increasing the near-term risk of active exploitation.

• CVE-2026-10177MEDIUM 6.3

  Aider-AI's Aider version 0.86.3 contains a server-side request forgery (SSRF) vulnerability in its AWS EC2 metadata endpoint handling. An authenticated attacker can exploit the requests.get function in api_docs.py to make the application fetch resources from arbitrary locations, potentially accessing sensitive internal services or metadata. The vulnerability is remotely exploitable and public disclosure has already occurred.

• CVE-2026-10180MEDIUM 6.3

  A command injection vulnerability exists in the TRENDnet TEW-432BRP router (firmware version 3.10B20) that allows authenticated users to execute arbitrary system commands through the formSysCmd web interface parameter. The vulnerability is in the /goform/formSysCmd endpoint and can be exploited remotely by anyone with network access and valid credentials. TRENDnet has not patched this issue because the router reached end-of-life in 2009 and is no longer supported.

• CVE-2026-10182MEDIUM 6.3

  A remote command injection vulnerability exists in the TRENDnet TEW-432BRP wireless router running firmware version 3.10B20. An authenticated attacker can exploit the WLAN setup function by manipulating the 'enrollee' parameter to execute arbitrary commands on the device. The vulnerability has been publicly disclosed. However, this router reached end-of-life in 2009—over 15 years ago—and the vendor has stated they cannot replicate or fix vulnerabilities in products no longer supported. Organizations still operating this hardware face unpatched exposure.

• CVE-2026-10193MEDIUM 6.3

  OFCMS versions up to 1.1.3 contain a SQL injection vulnerability in the ComnController component. An authenticated attacker can manipulate the 'system.user.query' parameter to inject malicious SQL commands, potentially accessing, modifying, or deleting database records. The vulnerability has been publicly disclosed and exploit code is available, making active exploitation a realistic threat.