2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 10 of 41

• CVE-2026-9153MEDIUM 6.5

  A vulnerability in the Rapid7 InsightConnect Sed Plugin allows authenticated users on Linux systems to read files they shouldn't have access to. The flaw exists because the plugin doesn't properly validate input in the expression parameter, enabling attackers to craft malicious commands that bypass restrictions and access sensitive files on the server.

• CVE-2026-9219MEDIUM 6.5

  Setracker2, an Android companion app for smartwatch management, contains a flaw in how it registers new devices. The app generates a unique registration ID based on the phone's IMEI number in a predictable way, and the enrollment system doesn't verify that the person requesting enrollment actually owns the watch being registered. An attacker who learns or guesses a registration ID could hijack someone else's smartwatch, taking control of it within the app and potentially accessing associated data or features.

• CVE-2026-9258MEDIUM 6.5

  Canon's EOS Network Setting Tool versions 1.5.0 and earlier fail to properly validate SSH host keys during network connections. This allows an attacker positioned to intercept network traffic—such as on a shared Wi-Fi network or compromised router—to impersonate a legitimate server without the user's knowledge. If successful, the attacker can eavesdrop on sensitive configuration data exchanged between the tool and the camera system, such as network credentials or camera settings. The vulnerability requires user interaction (the tool must be actively used to connect), but the bar for exploitation is low given the prevalence of unencrypted or poorly-secured network environments.

• CVE-2026-9259MEDIUM 6.5

  Canon EOS Network Setting Tool version 1.5.0 and earlier fails to properly validate SSL/TLS certificates when communicating with servers. This means an attacker positioned to intercept network traffic—such as on a shared Wi-Fi network or through a compromised router—could impersonate a legitimate Canon server and intercept sensitive data sent by the tool without the user noticing the certificate is invalid. The vulnerability requires user interaction to trigger (the tool must be actively used), but does not require special privileges. It affects Windows and macOS systems running the vulnerable tool.

• CVE-2026-9262MEDIUM 6.5

  Canon EOS Network Setting Tool versions 1.5.0 and earlier use an insecure FTP protocol by default when configuring network settings for Canon EOS cameras. An attacker positioned on the same network could intercept the unencrypted FTP connection to capture sensitive credentials or modify camera configuration data in transit. This affects both Windows and macOS users of the tool.

• CVE-2026-9263MEDIUM 6.5

  A vulnerability in Zephyr's Bluetooth controller allows a remote attacker to read sensitive memory from a device. The flaw exists in how the system handles Bluetooth ISO (isochronous) data frames. When a specially crafted ISO frame header arrives—either from a connected peer or a broadcaster the device is listening to—the controller fails to validate a length field properly. This causes it to read far more data from memory than it should and send that memory content to the host system as if it were legitimate data, exposing information that shouldn't be accessible. The vulnerability affects all Zephyr versions from 3.0.0 onward that support framed ISO reception.

• CVE-2026-9493MEDIUM 6.5

  BankPro E-Service Technology's Service Center contains a flaw that allows someone with valid login credentials to view order details belonging to other customers. An attacker would modify a query parameter to bypass access controls and retrieve sensitive EC order information that should only be visible to the rightful account owner. This is a classic authorization bypass—the application fails to verify that the requesting user actually owns the data they're asking for.

• CVE-2026-9539MEDIUM 6.5

  CVE-2026-9539 is a memory disclosure vulnerability in libslirp, a user-mode TCP/IP stack commonly used in hypervisor environments like QEMU. A privileged attacker running inside a guest virtual machine can craft malicious TCP packets to read sensitive data from the host system's memory. The vulnerability stems from improper handling of TCP urgent data flags and pointers, combined with an integer underflow condition. The attacker needs elevated privileges within the guest (root or CAP_NET_RAW capability), but can leak gigabytes of host heap memory, potentially exposing cryptographic keys, session tokens, or other confidential information.

• CVE-2026-9639MEDIUM 6.5

  CVE-2026-9639 is a denial-of-service vulnerability in LXD, Canonical's container and virtual machine management platform. An authenticated user with permission to create storage volumes can crash the LXD daemon by uploading a malformed backup file that is missing a required field. The vulnerability affects LXD versions up to 6.8 and 5.21 on Linux systems. An attacker would need valid credentials and specific permissions to exploit this, but no advanced technical skill is required once access is obtained.

• CVE-2026-9705MEDIUM 6.5

  Keycloak's client registration system contains a flaw that allows an attacker who holds an old Registration Access Token (RAT) to re-enable a client application that an administrator has intentionally disabled. Once re-enabled, the attacker can reset the client's secret, potentially regaining access to sensitive APIs and data. This vulnerability undermines administrator control over client lifecycle management and creates a window for unauthorized access.

• CVE-2026-9718MEDIUM 6.5

  CVE-2026-9718 is a denial-of-service vulnerability affecting Schneider Electric PowerLogic P7 devices. An authenticated user with network access can send a specially crafted request that causes an assertion failure in the device firmware, crashing the service and disrupting availability. The attacker must already have valid credentials to exploit this—it is not remotely exploitable by anonymous users. Impact is limited to availability; confidentiality and integrity remain unaffected.

• CVE-2026-9741MEDIUM 6.5

  MongoDB's encryption features—specifically Queryable Encryption and Client-Side Field Level Encryption (CSFLE)—contain a flaw in how they handle the $vectorSearch aggregation stage. When users filter encrypted data using $vectorSearch, literal values meant to stay encrypted are instead sent to the MongoDB server in plaintext. This defeats a core purpose of client-side encryption: keeping sensitive data encrypted at rest and in transit. An authenticated attacker with database access could potentially read these exposed field values, even though the bulk of the encrypted document remains protected.

• CVE-2026-9743MEDIUM 6.5

  MongoDB Server 8.0 has a vulnerability where certain aggregation queries can leave internal data structures in an inconsistent state. If an authenticated user follows up with a cursor operation (getMore), the server attempts to access a null pointer, causing the process to crash. Only users with authentication credentials can trigger this, but no special privileges are required—any authenticated database user can initiate the attack.

• CVE-2026-9746MEDIUM 6.5

  MongoDB servers can be forced to crash when a logged-in user executes a specific combination of change stream operations with resharding resume tokens and the exchange option. An attacker with valid database credentials can trigger this denial-of-service condition without elevated privileges, causing service disruption. The crash occurs due to an unhandled invariant violation in the server code.

• CVE-2026-9748MEDIUM 6.5

  MongoDB's internal index statistics conversion stage inadvertently uses a signal mechanism that was designed for a completely different purpose. When this stage appears before the $facet aggregation operator in a pipeline, MongoDB's document processing layer receives an unexpected control signal and crashes. This is a denial-of-service flaw that requires authenticated database access to trigger.

• CVE-2026-9749MEDIUM 6.5

  MongoDB servers running aggregation pipelines with specific internal configurations can encounter a denial-of-service condition when processing large result sets. The issue occurs in the $exchange stage when key-range partitioning routes many documents to the same consumer, causing a buffer management flaw that prevents proper tracking of data flow. This can lead to server instability or unavailability without authentication requirements beyond normal database access.

• CVE-2026-9750MEDIUM 6.5

  CVE-2026-9750 is a medium-severity vulnerability in MongoDB that allows authenticated users to crash the database server or cause it to return incorrect query results. The flaw occurs because MongoDB doesn't properly separate user-supplied document fields from its internal metadata during query processing, allowing a malicious or compromised account to exploit this weakness without requiring network access beyond normal database authentication.

• CVE-2026-9752MEDIUM 6.5

  An authenticated user can crash a MongoDB server by executing a specially crafted query against a 2dsphere geospatial index. The vulnerability exists because MongoDB's validation logic fails to properly inspect nested geometric objects within a GeoJSON GeometryCollection, allowing a forbidden strict-winding Polygon to bypass safety checks and trigger a null-pointer dereference that terminates the server process.

• CVE-2026-9754MEDIUM 6.5

  CVE-2026-9754 is a medium-severity information disclosure vulnerability in MongoDB that allows an authenticated user holding the read role to extract small amounts of uninitialized stack memory by sending specially crafted filemd5 commands. An attacker with valid database credentials and read permissions can trigger this flaw to leak sensitive data that may reside in memory, such as encryption keys, session tokens, or other confidential information. The vulnerability does not enable privilege escalation, data modification, or denial of service—only unauthorized information disclosure.

• CVE-2026-9774MEDIUM 6.5

  A directory traversal vulnerability in ATEN Unizon allows authenticated users with high-level privileges to delete arbitrary files on the system. The flaw exists in the updateLicense function, which fails to properly validate file paths before performing deletion operations. While authentication is required to exploit this issue, a compromised or malicious administrator account could use this to destroy critical system files, disable services, or trigger a denial-of-service condition.

• CVE-2026-9775MEDIUM 6.5

  ATEN Unizon contains a directory traversal vulnerability in its uploadSSL method that allows authenticated attackers to delete arbitrary files from the system. By bypassing path validation checks, an attacker with valid credentials can manipulate file paths to target and remove critical files, potentially disrupting system operations or triggering a denial-of-service condition.

• CVE-2026-9792MEDIUM 6.5

  Keycloak's Client Policies feature contains a bypass that weakens its security controls. When administrators configure policies to block the Resource Owner Password Credentials (ROPC) grant flow—a less secure authentication method—the system fails to enforce this restriction under certain conditions. An attacker can exploit this to obtain authentication tokens without proper authorization, potentially accessing sensitive data or impersonating legitimate users. The vulnerability affects how Keycloak validates policy conditions when client type, roles, attributes, or scopes are involved.

• CVE-2026-9796MEDIUM 6.5

  Keycloak has a timing vulnerability that allows an authenticated administrator with `manage-clients` permissions to temporarily escalate themselves to `realm-admin` role during a narrow window when role checks occur. Once granted, this elevated access persists indefinitely—even after the attacker's own admin permissions are removed or the system restarts. This creates a privilege escalation path that is difficult to detect and remediate after the fact.

• CVE-2026-9815MEDIUM 6.5

  A vulnerability in the MagicForm WordPress plugin (versions up to 0.1.3) allows anyone on the internet to upload executable PHP files to a website without authentication. This happens when form administrators leave the file upload field's extension allowlist empty—a configuration that appears to disable all validation. An attacker can exploit this to run arbitrary code on the server, potentially taking over the website or extracting sensitive data. The vulnerability is particularly dangerous because no login credentials or user interaction is required.

• CVE-2026-9822MEDIUM 6.5

  CVE-2026-9822 is a privilege-escalation vulnerability in the WP Hotel Booking WordPress plugin that allows users with basic Subscriber-level accounts to access sensitive information they shouldn't be able to see. Specifically, attackers can view other users' booking details, discover active discount coupons, and retrieve pricing data—all without administrator approval. The flaw stems from missing permission checks in several AJAX request handlers. Any WordPress site running the plugin before version 2.3.1 is affected if it allows user registration or has existing low-privilege accounts.

• CVE-2026-9829MEDIUM 6.5

  Photo Gallery by 10Web, a popular WordPress plugin for creating mobile-friendly image galleries, contains a SQL injection vulnerability in versions up to 1.8.41. An attacker with contributor-level WordPress access (a lower-privileged account type) can inject malicious SQL commands through a shortcode parameter called 'compact_album_order_by'. The attacker stores this payload via an unprotected AJAX function, and it executes when the gallery is viewed on the front end, allowing the attacker to extract sensitive database information. This is a stored vulnerability—once the malicious shortcode is saved, it affects all site visitors.

• CVE-2026-9882MEDIUM 6.5

  CVE-2026-9882 is a memory safety flaw in the ANGLE graphics library used by Google Chrome that allows attackers to steal data from websites you're visiting, provided they trick you into viewing a specially crafted web page. The vulnerability stems from an integer overflow—a programming error where a number wraps around unexpectedly—enabling unauthorized cross-origin data leakage. While the Chromium team rated this as "Critical," the CVSS base score of 6.5 reflects that successful exploitation requires user interaction (clicking or viewing content) and doesn't enable code execution or system-level damage. The flaw affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-9908MEDIUM 6.5

  CVE-2026-9908 is a memory disclosure flaw in Google Chrome's ANGLE graphics library that lets attackers read uninitialized or sensitive data from your browser process. An attacker crafts a malicious HTML page; when you visit it, the bug leaks information that shouldn't be accessible—such as encryption keys, session tokens, or other sensitive values that happened to be in memory. The vulnerability requires user interaction (clicking through to a malicious site) but no authentication, and it affects Chrome versions before 148.0.7778.216.

• CVE-2026-9912MEDIUM 6.5

  A flaw in Google Chrome's GPU processing on Android allows attackers to steal sensitive information from your device's memory. An attacker can craft a malicious web page that, when you visit it, extracts data from Chrome's process memory without your knowledge. No action from you is required beyond visiting the page—the vulnerability is triggered automatically during normal browsing.

• CVE-2026-9917MEDIUM 6.5

  Google Chrome on Android contains a flaw in its WebGL graphics processing that fails to properly initialize memory before use. When a user visits a malicious webpage, an attacker can read sensitive data left in process memory—such as parts of cached images, passwords, or other application state—without needing special permissions or bypass techniques. This affects Chrome versions before 148.0.7778.216 on Android devices.

• CVE-2026-9953MEDIUM 6.5

  CVE-2026-9953 is a memory safety bug in the ANGLE graphics library used by Google Chrome that allows an attacker to read sensitive data from the browser process. An attacker can craft a malicious HTML page that, when visited by a user, exploits an out-of-bounds read to leak information like passwords, session tokens, or other confidential data stored in Chrome's memory. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require special privileges and works across Windows, macOS, and Linux. Google has assigned it high severity within Chromium's security framework.

• CVE-2026-9981MEDIUM 6.5

  A flaw in the Skia graphics rendering library within Google Chrome allows attackers to trick users into visiting malicious web pages that expose sensitive data from the browser's memory. The vulnerability requires user interaction (clicking a link or visiting a site) but needs no special privileges to exploit, making it a realistic threat to everyday Chrome users.

• CVE-2026-9996MEDIUM 6.5

  A flaw in Google Chrome's WebRTC component allows a remote attacker to trick a user into visiting a malicious webpage that reads sensitive data from the browser's memory. The vulnerability affects Mac users running Chrome versions before 148.0.7778.216. No user action beyond visiting a crafted page is required for the attacker to attempt exploitation.

• CVE-2016-20070MEDIUM 6.4

  WordPress Booking Calendar Contact Form version 1.0.23 has two related security weaknesses that let attackers with basic subscriber accounts escalate their privileges and inject malicious code. An attacker can manipulate plugin settings and inject JavaScript that runs in administrator browsers, potentially compromising site integrity and administrative sessions. The plugin fails to properly check whether a user should have access to these sensitive functions and doesn't clean input before storing or displaying it.

• CVE-2021-47982MEDIUM 6.4

  WordPress administrators using the WP-Paginate plugin version 2.1.3 should be aware of a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the plugin's settings. An attacker with login credentials can submit crafted requests to the plugin configuration page, embedding JavaScript payloads that are permanently stored in the database and executed whenever site administrators access those settings. This means the payload runs in the admin's browser session, potentially allowing the attacker to steal session tokens, modify site content, create new admin accounts, or perform other harmful actions on behalf of the compromised administrator.

• CVE-2021-47983MEDIUM 6.4

  The Stripe Payments WordPress plugin version 2.0.39 contains a stored cross-site scripting (XSS) vulnerability that allows logged-in attackers to inject malicious JavaScript code into plugin settings. When an administrator views these compromised settings, the injected script executes in their browser with full administrative privileges. This type of attack is particularly dangerous because the malicious code persists in the database and affects all administrators who access the settings page.

• CVE-2021-47984MEDIUM 6.4

  The WP24 Domain Check WordPress plugin version 1.6.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with plugin access to inject malicious JavaScript code. When an admin later views the plugin's settings page, that injected code executes in their browser, potentially allowing the attacker to perform unauthorized actions on their behalf or steal sensitive information. This is a persistence threat—once injected, the malicious script remains in the plugin settings until manually removed.

• CVE-2025-14042MEDIUM 6.4

  The Automotive Car Dealership Business WordPress Theme contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 13.4.1. An attacker with contributor-level or higher permissions can inject malicious scripts into Portfolio Item 'Project Details' fields. These scripts will execute when other users view the affected pages, potentially compromising visitor sessions, stealing credentials, or defacing content. The vulnerability stems from the theme's failure to properly sanitize and escape user input in a custom field.

• CVE-2025-14785MEDIUM 6.4

  Website Builder by SeedProd—a popular WordPress plugin for creating landing pages, coming soon pages, and maintenance modes—contains a stored cross-site scripting (XSS) vulnerability in its nested menu widget shortcode. An authenticated user with contributor-level permissions or higher can embed malicious JavaScript into pages. That script then executes for anyone visiting the affected page, potentially compromising visitor data or session tokens. The vulnerability affects all versions through 6.20.2.

• CVE-2025-36320MEDIUM 6.4

  IBM watsonx.data intelligence contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript into the web interface. Once injected, the script persists and executes in the browsers of other users who access the affected page, potentially enabling attackers to steal session credentials or manipulate application behavior. The vulnerability affects versions 5.2.0 through 5.3.0 and requires valid user credentials to exploit.

• CVE-2025-59610MEDIUM 6.4

  A memory corruption vulnerability affects numerous Qualcomm chipsets and platforms when processing IOCTL (input/output control) requests that contain mismatched API versions. The flaw stems from concurrent modification of user-space buffers during processing, allowing a privileged local attacker to corrupt kernel memory and potentially gain elevated code execution. The vulnerability requires high privilege access and specific conditions to trigger, limiting opportunistic exploitation but posing significant risk in compromised or malicious insider scenarios.

• CVE-2025-8444MEDIUM 6.4

  A WordPress plugin called Animation Addons for Elementor (versions up to 2.6.7) allows authenticated users with contributor-level permissions to inject malicious scripts into pages. When other users visit those pages, the scripts execute in their browsers, potentially stealing session data, modifying page content, or performing actions on their behalf. The vulnerability stems from the plugin's failure to properly clean and validate user input before storing it.

• CVE-2026-0409MEDIUM 6.4

  NETGEAR Orbi 370 series mesh routers contain a vulnerability that allows attackers to execute arbitrary commands on the device. An attacker must intercept and modify network traffic between the router and the Internet, then wait for the device administrator to perform specific management actions. The vulnerability affects Orbi 370, 371, 372, and 374 models running firmware versions prior to V12.1.2.7.

• CVE-2026-10024MEDIUM 6.4

  The TinyMCE shortcode Addon plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 1.0.0. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code into pages via the 'btnrel' shortcode attribute. Because the plugin fails to properly sanitize and escape this input, the injected script will execute in the browsers of anyone who views the affected page. This is a *stored* vulnerability, meaning the malicious code persists in the page content until explicitly removed.

• CVE-2026-10089MEDIUM 6.4

  The Insert Pages plugin for WordPress has a security flaw where it fails to properly clean user-supplied text before displaying it on web pages. Specifically, when an author or administrator creates a custom field (metadata) with a specially crafted name and inserts a page using the plugin's shortcode, that malicious field name gets displayed without protection. This allows attackers to inject JavaScript code that runs in the browsers of anyone viewing the affected page. The vulnerability requires an authenticated account with author-level permissions or higher to exploit, which limits the immediate risk but still represents a meaningful threat in environments where multiple content creators have access.

• CVE-2026-10093MEDIUM 6.4

  A vulnerability in the File Sharing & Download Manager – User Private Files WordPress plugin allows authenticated users with subscriber-level permissions or higher to inject malicious scripts into pages. When other users visit an affected page, those scripts execute in their browsers, potentially leading to credential theft, session hijacking, or other client-side attacks. The flaw exists in how the plugin handles the 'fldr_ttl' parameter, failing to properly sanitize and escape user input.

• CVE-2026-10095MEDIUM 6.4

  WP Photo Album Plus, a popular WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability in versions up to 9.1.13.005. Attackers with contributor-level access or higher can inject malicious code through the 'subtext' parameter of the plugin's photo shortcode. When other users—including administrators—view the compromised post, the injected script executes in their browser, potentially allowing attackers to steal session tokens, modify content, or perform actions on their behalf. The vulnerability persists in the database, making it a lasting threat until patched.

• CVE-2026-10570MEDIUM 6.4

  The Sympl Repeater for ACF and Elementor plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated authors and higher-privileged users to inject malicious scripts into pages. When a page containing an affected repeater field is viewed by any site visitor, the injected script executes in their browser. The vulnerability stems from the plugin's failure to properly escape data when rendering ACF field values in Elementor, leaving user input exposed to script injection.

• CVE-2026-10653MEDIUM 6.4

  Zephyr's network buffer library has a race condition in how it tracks when buffers are no longer in use. The library uses reference counts to know when a buffer can be safely freed, but these counts are updated using regular (non-atomic) operations. When multiple threads or tasks share the same buffer and call the unref function simultaneously, a timing race can cause the library to think two different holders are the last user—leading to the same buffer being freed twice, memory corruption, and potential use-after-free conditions. The vulnerability affects multiple subsystems including networking, Bluetooth, USB, and message passing. Actual exploitation requires genuine concurrency, shared buffer architecture in the application, and precise timing; external attackers have limited ability to trigger it directly.

• CVE-2026-10732MEDIUM 6.4

  The decompress package contains a critical flaw that allows attackers to write files anywhere on a system by uploading a specially crafted ZIP archive. The vulnerability exploits a race condition in how the library processes ZIP entries: when a ZIP contains two entries with identical paths—first a symlink pointing to an arbitrary location, then a regular file—the library writes the file's contents through the symlink to a location outside the intended extraction folder. This bypasses protections added in previous fixes, potentially enabling remote code execution if an attacker can control ZIP uploads or extraction workflows.

• CVE-2026-10738MEDIUM 6.4

  The jQuery Hover Footnotes plugin for WordPress allows attackers who can write or edit content on a site (author-level access or higher) to hide malicious scripts inside footnote markup. These scripts execute whenever anyone views the affected page. The vulnerability exists because the plugin doesn't properly clean user input before storing it, and the hidden scripts bypass WordPress's built-in protections by using a specific syntax that avoids HTML tags.

• CVE-2026-10833MEDIUM 6.4

  Gutenberg Essential Blocks, a popular WordPress page builder plugin, contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 6.1.4. An authenticated WordPress user with Contributor-level permissions or higher can inject malicious JavaScript code through the 'configurablePrefix' block attribute. Once injected, this code executes whenever anyone visits the affected page, potentially compromising site visitors or enabling further attacks. The vulnerability stems from the plugin failing to properly sanitize user input and escape output in this specific block parameter.

• CVE-2026-10862MEDIUM 6.4

  The Accordions plugin for WordPress has a security flaw that allows authenticated users with custom-level permissions or higher to inject malicious scripts into accordion content. When other users view pages containing these injected scripts, the scripts execute in their browsers, potentially exposing sensitive information or performing unwanted actions on their behalf. This vulnerability affects all versions up to and including 2.3.23.

• CVE-2026-11328MEDIUM 6.4

  A WordPress plugin called Exclusive Addons for Elementor has a stored cross-site scripting (XSS) vulnerability affecting versions up to 2.7.9.8. An attacker with Contributor-level access or higher can inject malicious scripts into post titles that will execute whenever anyone visits the affected page. The vulnerability stems from the plugin's failure to properly sanitize and escape user input in the post title parameter.

• CVE-2026-11370MEDIUM 6.4

  The WP Meta SEO plugin for WordPress has a Server-Side Request Forgery (SSRF) vulnerability affecting all versions through 4.5.18. An authenticated user with contributor-level permissions or higher can manipulate the 'new_link' parameter in an AJAX request to force the WordPress server to make HTTP requests to internal systems, cloud metadata services, or other arbitrary network destinations. The vulnerability is particularly dangerous because the HTTP response status codes are reflected back to the attacker, effectively creating a reconnaissance tool for mapping internal infrastructure or extracting sensitive information from cloud environments like AWS metadata endpoints.

• CVE-2026-11380MEDIUM 6.4

  A WordPress plugin called JetWidgets For Elementor has a security flaw in its Animated Box widget that allows authenticated users with author-level permissions to inject malicious scripts into pages. When visitors view those pages, the injected scripts execute in their browsers. The vulnerability affects versions up to 1.0.21 and requires an attacker to already have login access to the WordPress site.

• CVE-2026-11402MEDIUM 6.4

  A WordPress plugin called Services Section Block allows attackers with contributor access or higher to inject malicious scripts into pages. When someone visits those pages, the hidden scripts run in their browser. The vulnerability exists because the plugin doesn't properly validate input or sanitize output when handling links in service blocks. The injected code hides in HTML comments, which lets it slip past WordPress's standard security checks.

• CVE-2026-11597MEDIUM 6.4

  A WordPress plugin called Surbma | Infusionsoft Shortcode (versions up to 2.0.1) fails to properly validate and sanitize user input when creating shortcodes that embed external scripts. An authenticated WordPress user with contributor access or higher can inject malicious code into shortcode parameters, which gets embedded in web pages. Any visitor to those pages will execute the injected script in their browser, potentially compromising their session or harvesting sensitive information. The vulnerability requires an authenticated user to exploit it, but once weaponized, affects all subsequent visitors to the compromised page.

• CVE-2026-11614MEDIUM 6.4

  The Xpro Addons plugin for WordPress, which provides 140+ widgets for the Elementor page builder, contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.7.2. An authenticated user with author-level permissions or higher can inject malicious JavaScript code through the 'custom_attributes' parameter. This code persists in the database and executes whenever anyone visits the affected page, potentially allowing the attacker to steal session tokens, modify page content, or redirect users to malicious sites.

• CVE-2026-11783MEDIUM 6.4

  The Dokan multivendor marketplace plugin for WordPress has a stored cross-site scripting (XSS) flaw in how it handles product SKU data. An authenticated user with custom-level access or higher can inject malicious scripts into a product's SKU field. When site visitors—including those not logged in—use the store search widget, the injected script executes in their browsers. This allows an attacker to steal session data, redirect users, deface pages, or perform actions on behalf of victims.

• CVE-2026-11945MEDIUM 6.4

  PostgreSQL Anonymizer, an extension for PostgreSQL that helps mask sensitive data, contains a privilege escalation vulnerability. An authenticated attacker with standard user privileges can craft a malicious JSON document and trick a database superuser into importing it using specific functions (import_database_rules() or import_roles_rules()). When the superuser processes the JSON, hidden malicious code executes with superuser-level privileges, giving the attacker complete database access. This requires both user authentication and superuser action, limiting the immediate risk but creating a serious supply-chain or trusted-user threat.

• CVE-2026-12098MEDIUM 6.4

  The PowerPress Podcasting plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with author-level or higher permissions to inject malicious scripts into podcast episode metadata. When other users view pages containing the injected content, the scripts execute in their browsers. The vulnerability exists because the plugin stores the 'embed' field directly to the database without proper sanitization, bypassing WordPress's built-in protections that normally filter such input. All versions up to and including 11.16.8 are affected.

• CVE-2026-12123MEDIUM 6.4

  The All-in-One Video Gallery plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability affecting all versions through 4.8.5. An attacker with subscriber-level WordPress access can exploit this flaw by inserting a malicious URL into a video post, then triggering an unauthenticated download endpoint that forces the server to fetch and return that URL's content. This allows the attacker to reach internal systems, access sensitive data, or modify services that should only be accessible internally.

• CVE-2026-12135MEDIUM 6.4

  The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'video_player' shortcode. An authenticated user with contributor-level permissions or higher can embed malicious JavaScript code into a page through the 'align' attribute. Once injected, this code executes automatically whenever anyone views the affected page, potentially allowing attackers to steal session cookies, redirect users, deface content, or perform other malicious actions on behalf of legitimate visitors.

• CVE-2026-12136MEDIUM 6.4

  The Customize My Account For Woocommerce plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Contributor-level permissions to inject malicious scripts into WordPress pages. The vulnerability exists in how the plugin processes user-supplied measurements for avatars—specifically height and width parameters—without properly sanitizing or escaping them before inserting them into page code. When other users visit an infected page, the injected script executes in their browsers, potentially allowing attackers to steal credentials, deface content, or perform actions on behalf of victims.

• CVE-2026-12154MEDIUM 6.4

  A WordPress plugin called Reviews Widgets for Google, Yelp & TripAdvisor contains a stored cross-site scripting (XSS) vulnerability in versions up to 2.7.3. An authenticated user with contributor-level permissions or higher can inject malicious scripts into a page using the plugin's shortcode feature. Once injected, those scripts execute whenever anyone visits the affected page, potentially compromising visitor accounts or stealing sensitive information. This requires an authenticated attacker with at least contributor access, which limits the immediate risk in most WordPress installations but remains serious for organizations with many trusted editors.

• CVE-2026-12157MEDIUM 6.4

  BetterDocs, a popular WordPress plugin that creates knowledge bases and FAQ sections, contains a security flaw that allows certain authenticated users to inject malicious code into pages. If a contributor or higher-privilege user exploits this, their injected script will run in the browsers of anyone who visits that page, potentially stealing information, redirecting users, or defacing content. The vulnerability exists in how the plugin handles a specific block setting called 'blockId' without properly cleaning or escaping it before displaying it on the page.

• CVE-2026-12170MEDIUM 6.4

  AcyMailing, a popular WordPress newsletter and marketing automation plugin, contains a stored cross-site scripting (XSS) flaw in its 'alignment' attribute handler. Authenticated WordPress contributors and higher-privileged users can inject malicious scripts that persist in the database and execute in the browsers of anyone viewing the affected pages. This affects all versions up to and including 10.10.2.

• CVE-2026-12610MEDIUM 6.4

  SSSD, the System Security Services Daemon used across Linux systems for authentication, contains a use-after-free flaw in its PAM responder that can be triggered when users authenticate using YubiKey or smartcard devices. An attacker with local access can craft malicious smartcard contents to crash the authentication service, causing denial of service. While privilege escalation is theoretically possible through this vulnerability, exploitation for that purpose is difficult and would require additional complexity. The primary risk is disruption of authentication services rather than straightforward privilege gain.

• CVE-2026-12731MEDIUM 6.4

  The weDocs WordPress plugin, used for creating AI-powered knowledge bases and documentation sites, contains a security flaw in how it handles certain block settings. Attackers with contributor-level access or higher can embed malicious scripts into pages through two specific settings (sectionTitleTag and articleTitleTag). These scripts execute whenever anyone views the compromised page, potentially compromising visitor security or stealing sensitive information. The vulnerability affects all versions up to and including 2.3.0.

• CVE-2026-12732MEDIUM 6.4

  LearnPress, a popular WordPress learning management plugin, contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 4.4.0. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code into a course template using the 'class_wrapper_form' shortcode attribute. Because the payload is stored in the database, any visitor to the affected page will automatically execute the attacker's script, potentially allowing session hijacking, credential theft, or content manipulation.

• CVE-2026-12734MEDIUM 6.4

  The weDocs WordPress plugin, which provides AI-powered documentation and knowledge base functionality, contains a stored cross-site scripting (XSS) vulnerability affecting all versions up to 2.3.0. An authenticated user with contributor-level permissions or higher can inject malicious scripts into pages through the 'connectorWidth' block attribute. These scripts persist in the database and execute for every visitor who views the compromised page, potentially allowing attackers to steal session data, deface content, or redirect users to malicious sites.

• CVE-2026-12924MEDIUM 6.4

  The Eventin plugin for WordPress, used for event management and ticketing, has a stored cross-site scripting (XSS) flaw in its FAQ content feature. An authenticated user with contributor permissions or higher can inject malicious code into FAQ sections. This code runs in the browsers of anyone viewing the affected pages, potentially stealing session data, redirecting users, or defacing content. The vulnerability affects all versions up to 4.1.15.

• CVE-2026-13246MEDIUM 6.4

  GiveWP, a popular WordPress donation and fundraising plugin, contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.16.0. An authenticated user with author-level permissions or higher can embed malicious JavaScript code into campaign comment shortcodes. When other users view pages containing these injected shortcodes, the malicious code executes in their browsers, potentially stealing session data, modifying page content, or redirecting users to phishing sites. The vulnerability stems from improper sanitization of the 'block_id' attribute and insufficient output escaping when rendering the shortcode.

• CVE-2026-13247MEDIUM 6.4

  A WordPress plugin called Logo Slider contains a security flaw that allows attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute whenever anyone visits the affected pages, potentially stealing data or performing unauthorized actions on behalf of visitors. The vulnerability exists in versions 5.5 and earlier due to improper handling of the 'lgx_tooltip_position' parameter.

• CVE-2026-13252MEDIUM 6.4

  The RSS Aggregator by Feedzy plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in how it handles the 'aspectRatio' attribute. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code into pages. When other users visit those pages, the injected script executes in their browsers, potentially allowing the attacker to steal session tokens, modify page content, or perform actions on behalf of legitimate users. The vulnerability affects all versions up to and including 5.2.1.

• CVE-2026-13253MEDIUM 6.4

  Ultimate Post, a WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability in its Advanced Search block feature. Authenticated users with contributor-level permissions or higher can embed malicious scripts into page content through the 'moreResultsText' attribute. When other users view an affected page, those scripts execute in their browsers, potentially compromising their accounts or session data. The vulnerability exists in plugin versions up to 5.0.31 and requires contributor access to exploit, which limits but does not eliminate risk in multi-author WordPress environments.

• CVE-2026-13295MEDIUM 6.4

  The Page Builder by SiteOrigin plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially allowing attackers to steal session cookies, redirect users, or perform actions on their behalf. This vulnerability affects all versions up to and including 2.34.3.

• CVE-2026-13318MEDIUM 6.4

  KubeVirt's port-forward feature contains a server-side request forgery (SSRF) vulnerability that allows an attacker to establish unauthorized network connections from the virt-api component to internal or external systems. The flaw stems from virt-api trusting the IP address reported by a guest VM without validation. An attacker with permissions to create VMs can exploit this by configuring a malicious guest agent to report an arbitrary IP address, then requesting a port-forward connection that tunnels traffic through virt-api's privileged network position, potentially bypassing network isolation controls.

• CVE-2026-13335MEDIUM 6.4

  The CodePeople Post Map for Google Maps WordPress plugin contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 1.2.6. An authenticated user with Contributor role or higher can inject malicious JavaScript into map point data that will execute in the browsers of anyone viewing the affected page. This is a *stored* vulnerability, meaning the malicious code persists and executes repeatedly, making it more dangerous than reflected XSS attacks.

• CVE-2026-13443MEDIUM 6.4

  A security flaw in the Tutor LMS WordPress plugin allows authenticated users with author-level permissions or higher to embed malicious JavaScript code into lesson attachments. When other users view pages containing these attachments, the injected script executes in their browsers, potentially compromising their accounts or stealing sensitive data. The vulnerability affects all versions up to 3.9.13 and requires an authenticated attacker—this is not a zero-authentication threat, but poses real risk in multiuser WordPress environments where content creators may be compromised or malicious.

• CVE-2026-13704MEDIUM 6.4

  GiveWP, a popular WordPress donation and fundraising plugin, contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 4.16.1. An authenticated attacker with Give Worker-level permissions or higher can inject malicious JavaScript code through the plugin's image introduction field. This injected code persists in the database and executes whenever any user views the affected page, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability requires authentication but affects site visitors who may not realize they've been compromised.

• CVE-2026-13710MEDIUM 6.4

  A popular WordPress plugin called Jeg Kit for Elementor (Powerful Addons for Elementor, Widgets & Templates) contains a stored cross-site scripting (XSS) vulnerability in its Image Box widget. The vulnerability exists because user-supplied text in the description field is not properly cleaned before being displayed on web pages. An authenticated user with Contributor role or higher can inject malicious JavaScript code through the description parameter. When other users visit a page containing the injected widget, the malicious script executes in their browsers, potentially allowing session hijacking, credential theft, or other client-side attacks. The vulnerability affects versions up to and including 3.2.6.

• CVE-2026-13733MEDIUM 6.4

  The Download Manager plugin for WordPress contains a security flaw that allows contributors and higher-privileged users to inject malicious JavaScript code into pages. The vulnerability exists in how the plugin handles the 'no_data_msg' shortcode attribute—specifically, it fails to properly clean the attribute value before displaying it. An attacker with contributor access can craft a specially formatted payload that bypasses WordPress's standard content filtering and executes arbitrary scripts whenever someone visits an affected page. This is a stored vulnerability, meaning the malicious code persists in the database and affects all visitors.

• CVE-2026-13771MEDIUM 6.4

  The Customer Reviews for WooCommerce plugin contains a stored cross-site scripting (XSS) flaw in its shortcode color attribute. Authenticated users with contributor-level permissions or higher can inject malicious scripts into pages; when other users visit those pages, the scripts execute in their browsers. This vulnerability affects all versions through 5.113.0.

• CVE-2026-14343MEDIUM 6.4

  The Download Manager plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions through 3.3.61. Authenticated users with contributor-level access or higher can inject malicious scripts through the 'note_before' and 'note_after' shortcode attributes. When other users view pages containing these injected shortcodes, the malicious scripts execute in their browsers. This is a persistent vulnerability—the injected code remains stored in the WordPress database and continues to pose a risk each time affected pages are accessed.

• CVE-2026-15284MEDIUM 6.4

  King Addons for Elementor, a popular WordPress plugin, contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 51.1.62. An authenticated attacker with subscriber-level permissions or higher can inject malicious scripts through the form page ID parameter. When administrators or other users view certain pages, the injected script executes in their browser, potentially allowing the attacker to steal credentials, modify content, or perform unauthorized actions on behalf of those users.

• CVE-2026-15285MEDIUM 6.4

  The Plus Addons for Elementor WordPress plugin contained a security flaw in how it handled custom attributes on button widgets. Contributors and higher-privilege users could inject malicious JavaScript code that would be stored in the database and then executed in the browsers of site visitors or administrators who viewed the affected page. The vulnerability has been patched in version 6.4.12.

• CVE-2026-15292MEDIUM 6.4

  The Sudoku Shortcode plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into pages. When someone visits an affected page, the injected script runs in their browser. The vulnerability exists because the plugin doesn't properly filter user input in the 'background' parameter of the sudoku-sc shortcode. All versions up to 1.0.0 are affected.

• CVE-2026-15296MEDIUM 6.4

  The WP Affiliate Plugin (affiliate-toolkit) for WordPress contains a stored cross-site scripting (XSS) vulnerability in its product shortcode feature. An attacker with contributor-level or higher privileges can embed malicious scripts into pages through poorly sanitized shortcode attributes. When anyone visits an affected page, the injected script executes in their browser, potentially compromising their session, stealing credentials, or performing unauthorized actions. This vulnerability affects all versions up to 3.7.0 and represents a bypass of a previously patched flaw (CVE-2024-10227).

• CVE-2026-15299MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in the Animation Addons for Elementor WordPress plugin affecting all versions through 2.6.3. An authenticated user with Contributor-level permissions or higher can inject malicious scripts through the Weather widget's configuration settings. These scripts are saved to the database and executed in the browsers of all site visitors who view the affected page, potentially compromising user sessions, stealing credentials, or defacing content. The vulnerability requires the Weather widget to be properly configured with an OpenWeatherMap API key to trigger the vulnerable code path.

• CVE-2026-15301MEDIUM 6.4

  The BuddyHolis TableSearch plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions 1.1.0 and earlier. Attackers with Contributor-level access or higher can inject malicious scripts through the 'placeholder' parameter. These scripts persist in the database and execute whenever any user views the affected page, potentially stealing credentials, session tokens, or performing actions on behalf of victims.

• CVE-2026-1856MEDIUM 6.4

  The Appointment Booking Calendar plugin for WordPress has a stored cross-site scripting (XSS) flaw affecting all versions through 1.4.4. An attacker with Author-level WordPress access or higher can inject malicious scripts into custom booking field labels. These scripts persist in the database and execute whenever anyone views the affected page, potentially stealing session cookies, hijacking accounts, or redirecting users to malicious sites. The vulnerability requires authenticated access, which limits its attack surface but makes it a concern for organizations managing multiple WordPress contributors or where account compromise is possible.

• CVE-2026-2021MEDIUM 6.4

  The Slideshow Gallery LITE plugin for WordPress contains a vulnerability that allows authenticated users with contributor-level permissions or higher to embed malicious scripts into pages. When other users visit an affected page, those scripts execute in their browsers. This is a stored cross-site scripting (XSS) flaw affecting all versions through 1.8.5, caused by the plugin failing to properly sanitize and escape the 'alwaysauto' shortcode attribute.

• CVE-2026-20454MEDIUM 6.4

  CVE-2026-20454 is a privilege escalation vulnerability in MediaTek's geniezone component affecting multiple system-on-chip (SoC) models. An attacker who already holds System privilege can exploit a race condition in memory handling to read or modify sensitive data and potentially gain higher-level control. No user interaction or network access is required—exploitation occurs locally once System privilege is obtained.

• CVE-2026-2382MEDIUM 6.4

  The FPW Category Thumbnails WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.9.5. Any user with Subscriber-level access or higher can inject malicious JavaScript through the 'id' parameter in an AJAX function. This script persists in the plugin's settings and executes whenever an administrator views that page, potentially compromising administrator accounts. The vulnerability stems from the plugin failing to properly clean and escape user input before storing and displaying it.

• CVE-2026-2387MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in the Event Organiser WordPress plugin affecting all versions up to and including 3.12.9. Authenticated users with Contributor-level permissions or higher can inject malicious scripts into event list pages through the 'eo_events' shortcode's 'no_events' parameter. These scripts persist in the database and execute in the browsers of anyone viewing the affected pages, potentially compromising site visitors.

• CVE-2026-25600MEDIUM 6.4

  PDBM application contains a critical cryptographic weakness: a single hard-coded encryption secret embedded in the executable file that is identical across all installations. This secret is used to encrypt and decrypt user credentials stored in the application's configuration files. An attacker with local system access can extract this secret from the PDBM.exe binary, then use it to decrypt stored administrative credentials. Because the default configuration assigns these credentials administrative privileges within PDBM, successful exploitation grants attackers complete control over the application's management functions and operational capabilities.

• CVE-2026-3011MEDIUM 6.4

  The Recipe Card Blocks Lite WordPress plugin contains a flaw that allows authenticated authors and above to inject malicious scripts into recipe blocks. These scripts execute when anyone views the published post or its print version, potentially compromising visitor sessions or redirecting them to malicious sites. The vulnerability exists because the plugin decodes special character sequences after security checks have already been completed, bypassing intended protections.

• CVE-2026-3251MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in Webremium Istanbul Web Design Mezunum Satiyorum versions 1.2.504 through 10072026. An authenticated attacker can inject malicious scripts into the application that will be permanently stored and executed in the browsers of other users who view the affected content. This allows credential theft, session hijacking, malware distribution, or defacement of the web application.