By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 52 of 86

• CVE-2026-11945MEDIUM 6.4

  PostgreSQL Anonymizer, an extension for PostgreSQL that helps mask sensitive data, contains a privilege escalation vulnerability. An authenticated attacker with standard user privileges can craft a malicious JSON document and trick a database superuser into importing it using specific functions (import_database_rules() or import_roles_rules()). When the superuser processes the JSON, hidden malicious code executes with superuser-level privileges, giving the attacker complete database access. This requires both user authentication and superuser action, limiting the immediate risk but creating a serious supply-chain or trusted-user threat.

• CVE-2026-12098MEDIUM 6.4

  The PowerPress Podcasting plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with author-level or higher permissions to inject malicious scripts into podcast episode metadata. When other users view pages containing the injected content, the scripts execute in their browsers. The vulnerability exists because the plugin stores the 'embed' field directly to the database without proper sanitization, bypassing WordPress's built-in protections that normally filter such input. All versions up to and including 11.16.8 are affected.

• CVE-2026-12123MEDIUM 6.4

  The All-in-One Video Gallery plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability affecting all versions through 4.8.5. An attacker with subscriber-level WordPress access can exploit this flaw by inserting a malicious URL into a video post, then triggering an unauthenticated download endpoint that forces the server to fetch and return that URL's content. This allows the attacker to reach internal systems, access sensitive data, or modify services that should only be accessible internally.

• CVE-2026-12135MEDIUM 6.4

  The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'video_player' shortcode. An authenticated user with contributor-level permissions or higher can embed malicious JavaScript code into a page through the 'align' attribute. Once injected, this code executes automatically whenever anyone views the affected page, potentially allowing attackers to steal session cookies, redirect users, deface content, or perform other malicious actions on behalf of legitimate visitors.

• CVE-2026-12136MEDIUM 6.4

  The Customize My Account For Woocommerce plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Contributor-level permissions to inject malicious scripts into WordPress pages. The vulnerability exists in how the plugin processes user-supplied measurements for avatars—specifically height and width parameters—without properly sanitizing or escaping them before inserting them into page code. When other users visit an infected page, the injected script executes in their browsers, potentially allowing attackers to steal credentials, deface content, or perform actions on behalf of victims.

• CVE-2026-12154MEDIUM 6.4

  A WordPress plugin called Reviews Widgets for Google, Yelp & TripAdvisor contains a stored cross-site scripting (XSS) vulnerability in versions up to 2.7.3. An authenticated user with contributor-level permissions or higher can inject malicious scripts into a page using the plugin's shortcode feature. Once injected, those scripts execute whenever anyone visits the affected page, potentially compromising visitor accounts or stealing sensitive information. This requires an authenticated attacker with at least contributor access, which limits the immediate risk in most WordPress installations but remains serious for organizations with many trusted editors.

• CVE-2026-12157MEDIUM 6.4

  BetterDocs, a popular WordPress plugin that creates knowledge bases and FAQ sections, contains a security flaw that allows certain authenticated users to inject malicious code into pages. If a contributor or higher-privilege user exploits this, their injected script will run in the browsers of anyone who visits that page, potentially stealing information, redirecting users, or defacing content. The vulnerability exists in how the plugin handles a specific block setting called 'blockId' without properly cleaning or escaping it before displaying it on the page.

• CVE-2026-12170MEDIUM 6.4

  AcyMailing, a popular WordPress newsletter and marketing automation plugin, contains a stored cross-site scripting (XSS) flaw in its 'alignment' attribute handler. Authenticated WordPress contributors and higher-privileged users can inject malicious scripts that persist in the database and execute in the browsers of anyone viewing the affected pages. This affects all versions up to and including 10.10.2.

• CVE-2026-12610MEDIUM 6.4

  SSSD, the System Security Services Daemon used across Linux systems for authentication, contains a use-after-free flaw in its PAM responder that can be triggered when users authenticate using YubiKey or smartcard devices. An attacker with local access can craft malicious smartcard contents to crash the authentication service, causing denial of service. While privilege escalation is theoretically possible through this vulnerability, exploitation for that purpose is difficult and would require additional complexity. The primary risk is disruption of authentication services rather than straightforward privilege gain.

• CVE-2026-12731MEDIUM 6.4

  The weDocs WordPress plugin, used for creating AI-powered knowledge bases and documentation sites, contains a security flaw in how it handles certain block settings. Attackers with contributor-level access or higher can embed malicious scripts into pages through two specific settings (sectionTitleTag and articleTitleTag). These scripts execute whenever anyone views the compromised page, potentially compromising visitor security or stealing sensitive information. The vulnerability affects all versions up to and including 2.3.0.

• CVE-2026-12732MEDIUM 6.4

  LearnPress, a popular WordPress learning management plugin, contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 4.4.0. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code into a course template using the 'class_wrapper_form' shortcode attribute. Because the payload is stored in the database, any visitor to the affected page will automatically execute the attacker's script, potentially allowing session hijacking, credential theft, or content manipulation.

• CVE-2026-12734MEDIUM 6.4

  The weDocs WordPress plugin, which provides AI-powered documentation and knowledge base functionality, contains a stored cross-site scripting (XSS) vulnerability affecting all versions up to 2.3.0. An authenticated user with contributor-level permissions or higher can inject malicious scripts into pages through the 'connectorWidth' block attribute. These scripts persist in the database and execute for every visitor who views the compromised page, potentially allowing attackers to steal session data, deface content, or redirect users to malicious sites.

• CVE-2026-12924MEDIUM 6.4

  The Eventin plugin for WordPress, used for event management and ticketing, has a stored cross-site scripting (XSS) flaw in its FAQ content feature. An authenticated user with contributor permissions or higher can inject malicious code into FAQ sections. This code runs in the browsers of anyone viewing the affected pages, potentially stealing session data, redirecting users, or defacing content. The vulnerability affects all versions up to 4.1.15.

• CVE-2026-13246MEDIUM 6.4

  GiveWP, a popular WordPress donation and fundraising plugin, contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.16.0. An authenticated user with author-level permissions or higher can embed malicious JavaScript code into campaign comment shortcodes. When other users view pages containing these injected shortcodes, the malicious code executes in their browsers, potentially stealing session data, modifying page content, or redirecting users to phishing sites. The vulnerability stems from improper sanitization of the 'block_id' attribute and insufficient output escaping when rendering the shortcode.

• CVE-2026-13247MEDIUM 6.4

  A WordPress plugin called Logo Slider contains a security flaw that allows attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute whenever anyone visits the affected pages, potentially stealing data or performing unauthorized actions on behalf of visitors. The vulnerability exists in versions 5.5 and earlier due to improper handling of the 'lgx_tooltip_position' parameter.

• CVE-2026-13252MEDIUM 6.4

  The RSS Aggregator by Feedzy plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in how it handles the 'aspectRatio' attribute. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code into pages. When other users visit those pages, the injected script executes in their browsers, potentially allowing the attacker to steal session tokens, modify page content, or perform actions on behalf of legitimate users. The vulnerability affects all versions up to and including 5.2.1.

• CVE-2026-13253MEDIUM 6.4

  Ultimate Post, a WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability in its Advanced Search block feature. Authenticated users with contributor-level permissions or higher can embed malicious scripts into page content through the 'moreResultsText' attribute. When other users view an affected page, those scripts execute in their browsers, potentially compromising their accounts or session data. The vulnerability exists in plugin versions up to 5.0.31 and requires contributor access to exploit, which limits but does not eliminate risk in multi-author WordPress environments.

• CVE-2026-13295MEDIUM 6.4

  The Page Builder by SiteOrigin plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially allowing attackers to steal session cookies, redirect users, or perform actions on their behalf. This vulnerability affects all versions up to and including 2.34.3.

• CVE-2026-13318MEDIUM 6.4

  KubeVirt's port-forward feature contains a server-side request forgery (SSRF) vulnerability that allows an attacker to establish unauthorized network connections from the virt-api component to internal or external systems. The flaw stems from virt-api trusting the IP address reported by a guest VM without validation. An attacker with permissions to create VMs can exploit this by configuring a malicious guest agent to report an arbitrary IP address, then requesting a port-forward connection that tunnels traffic through virt-api's privileged network position, potentially bypassing network isolation controls.

• CVE-2026-13335MEDIUM 6.4

  The CodePeople Post Map for Google Maps WordPress plugin contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 1.2.6. An authenticated user with Contributor role or higher can inject malicious JavaScript into map point data that will execute in the browsers of anyone viewing the affected page. This is a *stored* vulnerability, meaning the malicious code persists and executes repeatedly, making it more dangerous than reflected XSS attacks.

• CVE-2026-13443MEDIUM 6.4

  A security flaw in the Tutor LMS WordPress plugin allows authenticated users with author-level permissions or higher to embed malicious JavaScript code into lesson attachments. When other users view pages containing these attachments, the injected script executes in their browsers, potentially compromising their accounts or stealing sensitive data. The vulnerability affects all versions up to 3.9.13 and requires an authenticated attacker—this is not a zero-authentication threat, but poses real risk in multiuser WordPress environments where content creators may be compromised or malicious.

• CVE-2026-13704MEDIUM 6.4

  GiveWP, a popular WordPress donation and fundraising plugin, contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 4.16.1. An authenticated attacker with Give Worker-level permissions or higher can inject malicious JavaScript code through the plugin's image introduction field. This injected code persists in the database and executes whenever any user views the affected page, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability requires authentication but affects site visitors who may not realize they've been compromised.

• CVE-2026-13710MEDIUM 6.4

  A popular WordPress plugin called Jeg Kit for Elementor (Powerful Addons for Elementor, Widgets & Templates) contains a stored cross-site scripting (XSS) vulnerability in its Image Box widget. The vulnerability exists because user-supplied text in the description field is not properly cleaned before being displayed on web pages. An authenticated user with Contributor role or higher can inject malicious JavaScript code through the description parameter. When other users visit a page containing the injected widget, the malicious script executes in their browsers, potentially allowing session hijacking, credential theft, or other client-side attacks. The vulnerability affects versions up to and including 3.2.6.

• CVE-2026-13733MEDIUM 6.4

  The Download Manager plugin for WordPress contains a security flaw that allows contributors and higher-privileged users to inject malicious JavaScript code into pages. The vulnerability exists in how the plugin handles the 'no_data_msg' shortcode attribute—specifically, it fails to properly clean the attribute value before displaying it. An attacker with contributor access can craft a specially formatted payload that bypasses WordPress's standard content filtering and executes arbitrary scripts whenever someone visits an affected page. This is a stored vulnerability, meaning the malicious code persists in the database and affects all visitors.

• CVE-2026-13771MEDIUM 6.4

  The Customer Reviews for WooCommerce plugin contains a stored cross-site scripting (XSS) flaw in its shortcode color attribute. Authenticated users with contributor-level permissions or higher can inject malicious scripts into pages; when other users visit those pages, the scripts execute in their browsers. This vulnerability affects all versions through 5.113.0.

• CVE-2026-14343MEDIUM 6.4

  The Download Manager plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions through 3.3.61. Authenticated users with contributor-level access or higher can inject malicious scripts through the 'note_before' and 'note_after' shortcode attributes. When other users view pages containing these injected shortcodes, the malicious scripts execute in their browsers. This is a persistent vulnerability—the injected code remains stored in the WordPress database and continues to pose a risk each time affected pages are accessed.

• CVE-2026-15284MEDIUM 6.4

  King Addons for Elementor, a popular WordPress plugin, contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 51.1.62. An authenticated attacker with subscriber-level permissions or higher can inject malicious scripts through the form page ID parameter. When administrators or other users view certain pages, the injected script executes in their browser, potentially allowing the attacker to steal credentials, modify content, or perform unauthorized actions on behalf of those users.

• CVE-2026-15285MEDIUM 6.4

  The Plus Addons for Elementor WordPress plugin contained a security flaw in how it handled custom attributes on button widgets. Contributors and higher-privilege users could inject malicious JavaScript code that would be stored in the database and then executed in the browsers of site visitors or administrators who viewed the affected page. The vulnerability has been patched in version 6.4.12.

• CVE-2026-15292MEDIUM 6.4

  The Sudoku Shortcode plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into pages. When someone visits an affected page, the injected script runs in their browser. The vulnerability exists because the plugin doesn't properly filter user input in the 'background' parameter of the sudoku-sc shortcode. All versions up to 1.0.0 are affected.

• CVE-2026-15296MEDIUM 6.4

  The WP Affiliate Plugin (affiliate-toolkit) for WordPress contains a stored cross-site scripting (XSS) vulnerability in its product shortcode feature. An attacker with contributor-level or higher privileges can embed malicious scripts into pages through poorly sanitized shortcode attributes. When anyone visits an affected page, the injected script executes in their browser, potentially compromising their session, stealing credentials, or performing unauthorized actions. This vulnerability affects all versions up to 3.7.0 and represents a bypass of a previously patched flaw (CVE-2024-10227).

• CVE-2026-15299MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in the Animation Addons for Elementor WordPress plugin affecting all versions through 2.6.3. An authenticated user with Contributor-level permissions or higher can inject malicious scripts through the Weather widget's configuration settings. These scripts are saved to the database and executed in the browsers of all site visitors who view the affected page, potentially compromising user sessions, stealing credentials, or defacing content. The vulnerability requires the Weather widget to be properly configured with an OpenWeatherMap API key to trigger the vulnerable code path.

• CVE-2026-15301MEDIUM 6.4

  The BuddyHolis TableSearch plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions 1.1.0 and earlier. Attackers with Contributor-level access or higher can inject malicious scripts through the 'placeholder' parameter. These scripts persist in the database and execute whenever any user views the affected page, potentially stealing credentials, session tokens, or performing actions on behalf of victims.

• CVE-2026-1856MEDIUM 6.4

  The Appointment Booking Calendar plugin for WordPress has a stored cross-site scripting (XSS) flaw affecting all versions through 1.4.4. An attacker with Author-level WordPress access or higher can inject malicious scripts into custom booking field labels. These scripts persist in the database and execute whenever anyone views the affected page, potentially stealing session cookies, hijacking accounts, or redirecting users to malicious sites. The vulnerability requires authenticated access, which limits its attack surface but makes it a concern for organizations managing multiple WordPress contributors or where account compromise is possible.

• CVE-2026-2021MEDIUM 6.4

  The Slideshow Gallery LITE plugin for WordPress contains a vulnerability that allows authenticated users with contributor-level permissions or higher to embed malicious scripts into pages. When other users visit an affected page, those scripts execute in their browsers. This is a stored cross-site scripting (XSS) flaw affecting all versions through 1.8.5, caused by the plugin failing to properly sanitize and escape the 'alwaysauto' shortcode attribute.

• CVE-2026-20454MEDIUM 6.4

  CVE-2026-20454 is a privilege escalation vulnerability in MediaTek's geniezone component affecting multiple system-on-chip (SoC) models. An attacker who already holds System privilege can exploit a race condition in memory handling to read or modify sensitive data and potentially gain higher-level control. No user interaction or network access is required—exploitation occurs locally once System privilege is obtained.

• CVE-2026-2382MEDIUM 6.4

  The FPW Category Thumbnails WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.9.5. Any user with Subscriber-level access or higher can inject malicious JavaScript through the 'id' parameter in an AJAX function. This script persists in the plugin's settings and executes whenever an administrator views that page, potentially compromising administrator accounts. The vulnerability stems from the plugin failing to properly clean and escape user input before storing and displaying it.

• CVE-2026-2387MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in the Event Organiser WordPress plugin affecting all versions up to and including 3.12.9. Authenticated users with Contributor-level permissions or higher can inject malicious scripts into event list pages through the 'eo_events' shortcode's 'no_events' parameter. These scripts persist in the database and execute in the browsers of anyone viewing the affected pages, potentially compromising site visitors.

• CVE-2026-25600MEDIUM 6.4

  PDBM application contains a critical cryptographic weakness: a single hard-coded encryption secret embedded in the executable file that is identical across all installations. This secret is used to encrypt and decrypt user credentials stored in the application's configuration files. An attacker with local system access can extract this secret from the PDBM.exe binary, then use it to decrypt stored administrative credentials. Because the default configuration assigns these credentials administrative privileges within PDBM, successful exploitation grants attackers complete control over the application's management functions and operational capabilities.

• CVE-2026-3011MEDIUM 6.4

  The Recipe Card Blocks Lite WordPress plugin contains a flaw that allows authenticated authors and above to inject malicious scripts into recipe blocks. These scripts execute when anyone views the published post or its print version, potentially compromising visitor sessions or redirecting them to malicious sites. The vulnerability exists because the plugin decodes special character sequences after security checks have already been completed, bypassing intended protections.

• CVE-2026-3251MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in Webremium Istanbul Web Design Mezunum Satiyorum versions 1.2.504 through 10072026. An authenticated attacker can inject malicious scripts into the application that will be permanently stored and executed in the browsers of other users who view the affected content. This allows credential theft, session hijacking, malware distribution, or defacement of the web application.

• CVE-2026-3297MEDIUM 6.4

  A vulnerability in the Pagelayer WordPress plugin allows users with contributor access or higher to inject malicious code into pages through the Anchor block feature. Because the plugin doesn't properly validate and escape user input, this injected code runs whenever anyone visits the affected page, potentially compromising site visitors or stealing their data.

• CVE-2026-34993MEDIUM 6.4

  AIOHTTP, a popular Python framework for asynchronous HTTP operations, contains a vulnerability in its CookieJar.load() function that could allow code execution when loading untrusted cookie data. The vulnerability exists in versions before 3.14.0. While the risk is moderate, it primarily affects applications that explicitly load cookie files from untrusted sources—a less common pattern than using CookieJar with application-generated data. Upgrading to version 3.14.0 or later eliminates the risk.

• CVE-2026-36612MEDIUM 6.4

  The Mercusys AC12G (EU) router with firmware version AC12G(EU)_V1_200909 ships with Wi-Fi Protected Setup (WPS) enabled by default. WPS is a feature designed to simplify device pairing, but this implementation has a critical weakness: after just 10 failed PIN guesses, the device locks out for only 60 seconds. This short lockout window makes brute-force attacks against the WPS PIN feasible within a reasonable timeframe, potentially allowing an attacker within wireless range to gain administrative access to the router.

• CVE-2026-3722MEDIUM 6.4

  A WordPress plugin called 'Auto Image Attributes From Filename With Bulk Updater' fails to properly clean and display user-supplied data in image metadata fields. This allows authenticated users with Author-level permissions or higher to embed malicious code into image properties. When site visitors view pages containing the injected image, that code runs in their browsers—potentially stealing session cookies, performing actions on their behalf, or redirecting them to malicious sites. The vulnerability affects all versions up to and including 4.9.

• CVE-2026-3907MEDIUM 6.4

  The Hostel WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its booking shortcode feature. An authenticated user with Contributor-level permissions or higher can inject malicious JavaScript code into a page by crafting a specially-formed shortcode. When other users visit that page, the injected script executes in their browsers, potentially allowing the attacker to steal session cookies, deface content, or redirect users to malicious sites. The vulnerability exists in all versions up to 1.1.7 and stems from the plugin failing to properly sanitize and escape user input before displaying it on the page.

• CVE-2026-39594MEDIUM 6.4

  A broken access control flaw in Ultra Addons for WPForms allows authenticated users to perform actions they shouldn't be permitted to perform, potentially modifying content or disrupting service for other users. The vulnerability affects versions up to and including 1.0.11. While an attacker needs a valid login, the impact extends across the broader WordPress installation, making this a medium-severity issue that requires prompt attention from site administrators running the affected plugin.

• CVE-2026-4080MEDIUM 6.4

  The Easy Cart plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'add_to_cart' shortcode. Attackers with Contributor-level access or above can inject malicious scripts into shortcode parameters that will execute for any user viewing the affected page. The vulnerability stems from incomplete sanitization—while HTML tags are stripped, quotation marks are not escaped, allowing attackers to break out of HTML attribute context and inject event handlers like onclick or onerror. All versions through 1.8 are affected.

• CVE-2026-4081MEDIUM 6.4

  The ZeM STL plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into website pages. When someone visits a page containing the injected script, their browser executes the attacker's code. This happens because the plugin doesn't properly clean or escape user input when processing shortcode parameters like 'url', 'color', and 'bgcolor'. All versions up to 1.0 are affected.

• CVE-2026-40985MEDIUM 6.4

  Spring Web Flow applications that use the WebFlowELExpressionParser are vulnerable to malicious Unified EL (Expression Language) expressions. An authenticated user with some social engineering (such as tricking a legitimate user into clicking a link or interacting with a crafted form) could inject harmful expressions into the application, potentially exposing sensitive data or modifying application state. The vulnerability requires user interaction and authenticated access, making it a moderate-risk issue for organizations running vulnerable Spring Web Flow versions.

• CVE-2026-41719MEDIUM 6.4

  Spring Data KeyValue and Spring Data Redis are widely used libraries for integrating key-value stores with Spring applications. A vulnerability in these libraries allows an attacker with authenticated access to inject malicious SpEL (Spring Expression Language) code through the Sort parameter of repository query methods. When the application passes unsanitized user input to sorting operations, the SpelPropertyComparator evaluates that input as executable code rather than treating it as data. This could allow an authenticated user to read sensitive data, modify application behavior, or degrade system availability.

• CVE-2026-41982MEDIUM 6.4

  CVE-2026-41982 is a race condition vulnerability affecting the IPC (inter-process communication) module. An authenticated attacker can exploit this flaw to degrade system availability. The vulnerability requires specific conditions to trigger and is rated MEDIUM severity with a CVSS score of 6.4.

• CVE-2026-4328MEDIUM 6.4

  The Advanced Import plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated users with Author-level permissions or higher to make web requests from the vulnerable server to arbitrary internal or external locations. An attacker can exploit this by supplying a specially crafted URL through the plugin's demo file import feature, enabling them to access sensitive data from cloud metadata endpoints, internal databases, or other restricted services on the organization's network. The vulnerability stems from incomplete input validation—the plugin sanitizes only for XSS threats but fails to prevent requests to private network resources, despite using safer alternatives elsewhere in the codebase.

• CVE-2026-4334MEDIUM 6.4

  The Shariff Wrapper plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.6.20. Attackers with Contributor-level access or higher can inject malicious scripts through the 'headline' parameter in the [shariff] shortcode. When other users view the affected page, the injected code executes in their browsers, potentially enabling session hijacking, credential theft, or further compromise. The vulnerability stems from the plugin's use of a permissive HTML sanitization routine followed by unsafe string replacement operations that reintroduce dangerous content after the sanitization check.

• CVE-2026-44462MEDIUM 6.4

  Zed is a popular code editor that includes a terminal tool with permission controls meant to restrict which commands can be executed. Prior to version 0.229.0, an attacker could bypass these restrictions by chaining bash variable expansion syntax—specifically the ${var@P} expansion—to execute arbitrary commands even when they appeared to violate the allowed command prefix rules. This requires user interaction (opening a malicious project or terminal configuration) but grants the attacker code execution within the editor's process context.

• CVE-2026-45285MEDIUM 6.4

  Nextcloud inadvertently creates hidden public links when users share folders or files with Teams that include external members (people invited via email without Nextcloud accounts). These links remain invisible in the sharing interface but are emailed to the external recipient and grant full permissions—read, write, delete, reshare, download. An attacker intercepting or receiving one of these links gains unfettered access to all shared data without authentication, and the folder owner cannot see or revoke the link through normal UI controls. Versions 32.0.0–32.0.8 and 33.0.0–33.0.2 are vulnerable; patches are available.

• CVE-2026-4610MEDIUM 6.4

  The ProfileGrid plugin for WordPress, used for managing user profiles and community features, contains a security flaw that allows authenticated users (those with Subscriber level access or higher) to inject malicious scripts into pages. When other users visit those affected pages, the injected scripts execute in their browsers, potentially compromising their sessions or stealing data. The vulnerability affects all versions up to 5.9.9.2, though a partial fix was introduced in version 5.9.8.5.

• CVE-2026-4653MEDIUM 6.4

  The Block, Suspend, Report for BuddyPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows any logged-in user with subscriber access or higher to inject malicious scripts into the plugin's pages. When other users visit those pages, the injected scripts execute in their browsers, potentially allowing attackers to steal session cookies, deface content, or perform actions on behalf of victims. The vulnerability exists in versions 3.6.4 and earlier due to the plugin failing to properly filter the 'link' parameter before displaying it.

• CVE-2026-47268MEDIUM 6.4

  Nezha Monitoring, a self-hosted server and website monitoring tool, contains a vulnerability in its DDNS (Dynamic DNS) webhook feature. An authenticated user with low privileges can configure a malicious webhook URL that the dashboard will call whenever DDNS is triggered. Because these webhook requests bypass the safety checks normally applied to internal requests, an attacker can make the dashboard server connect to internal services or loopback addresses on the dashboard host itself. While the attacker cannot directly see the responses from these internal services, they can still issue commands that change state or probe for vulnerabilities. This requires an authenticated account and a server under the attacker's control, but the impact could include unauthorized access to internal monitoring endpoints or other backend services.

• CVE-2026-4804MEDIUM 6.4

  The Zakra WordPress theme contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.2.0. An authenticated user with basic contributor permissions can inject malicious JavaScript into specific theme settings that gets saved and executed whenever anyone views the affected page. The vulnerability exists because the theme fails to validate user input through its REST API, even though it does sanitize input from the classic editor. This allows attackers to compromise visitor sessions and steal data without needing to exploit any other systems.

• CVE-2026-48167MEDIUM 6.4

  Filament, a popular Laravel development framework, contains a stored cross-site scripting (XSS) vulnerability in its ImageColumn and ImageEntry components. These components display database images without sanitizing the underlying data, allowing an attacker to inject malicious HTML or JavaScript. If an attacker can control the image data stored in the database—typically through an application feature that accepts user uploads or metadata—the injected code executes when other users view the affected table or schema. This is a persistence risk: the attack payload stays in the database and impacts every user who accesses that view.

• CVE-2026-50014MEDIUM 6.4

  pnpm, a widely-used Node.js package manager, contains a command-injection vulnerability in how it processes git repository references. When pnpm resolves dependencies from git sources, it reads commit hashes from the project's lockfile. A malicious lockfile can inject git command-line options (like `--upload-pack`) in place of a legitimate commit hash. For projects using SSH or local git repositories, this allows an attacker to execute arbitrary commands during dependency installation. HTTPS-based git dependencies are not affected because the git client ignores the malicious option in that context. The vulnerability requires an attacker to control or modify the lockfile and a user to install dependencies, making it a supply-chain vector rather than a network-direct attack.

• CVE-2026-50592MEDIUM 6.4

  Znuny, a widely-used open-source helpdesk and ticketing platform, contains a reflected cross-site scripting (XSS) vulnerability in its administrative communication log interface. An authenticated attacker with login credentials can craft a malicious URL containing injected JavaScript that executes in the browser of another administrator viewing the communication logs. This could allow credential theft, session hijacking, or other actions performed on behalf of the compromised administrator. The vulnerability affects Znuny LTS versions before 6.5.21 and Znuny versions before 7.3.3.

• CVE-2026-5220MEDIUM 6.4

  DivvyDrive, a file collaboration and sharing platform by DivvyDrive Information Technologies Inc., contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the application. When other users access pages containing this injected content, the malicious code executes in their browsers, potentially allowing attackers to steal session tokens, modify data, or perform actions on behalf of victims. The vulnerability affects versions 4.8.2.23 through 4.8.3.0; version 4.8.3.1 and later resolve the issue.

• CVE-2026-52781MEDIUM 6.4

  OpenProject, a popular open-source project management platform, contains a vulnerability in how it sanitizes HTML content in work package descriptions. An attacker with login credentials can inject malicious code that exploits Stimulus.js, a JavaScript framework, to automatically execute commands in the browsers of other authenticated users. This could redirect victims to phishing sites or other attacker-controlled locations without their knowledge. The flaw affects all versions before 17.3.3 and 17.4.1.

• CVE-2026-53521MEDIUM 6.4

  Nezha Monitoring, a lightweight self-hosted server monitoring tool, contains a flaw in versions 2.0.14 through 2.0.x that allows attackers to hijack DDNS (Dynamic DNS) profile updates. An authenticated user can save references to nonexistent DDNS profiles on their server. Later, if another user creates a DDNS profile matching one of those IDs, the monitoring system will incorrectly use the new user's DDNS configuration to push updates to the attacker's infrastructure. This creates a cross-user context confusion where DDNS changes intended for one user leak into another user's server configuration. The issue is resolved in version 2.1.0.

• CVE-2026-53987MEDIUM 6.4

  A vulnerability in the Tag plugin for GLPI 11 allows authenticated users with tag management privileges to inject malicious HTML code into tag names. Because the plugin fails to sanitize tag names when storing them and doesn't escape output when displaying tags in Kanban views, the injected code executes in the browsers of any user viewing tickets, problems, changes, or projects that use those tags. This is a stored cross-site scripting (XSS) vulnerability that persists until the malicious tag is removed.

• CVE-2026-54015MEDIUM 6.4

  Open WebUI, a self-hosted AI platform, contains a vulnerability in how it manages access to saved prompt versions and history. Before version 0.9.6, the application checks that you own a prompt before letting you view its history, but fails to verify that individual history entries actually belong to that prompt. An attacker with legitimate access to any prompt they control can exploit this flaw to read or delete the saved version history of other users' private prompts, provided they can discover a history entry ID. The vulnerability requires authentication and knowledge of specific history entry identifiers, limiting its practical reach but making it a serious concern for multi-user deployments.

• CVE-2026-54306MEDIUM 6.4

  n8n, a popular open-source workflow automation platform, contains a prototype pollution vulnerability that allows attackers to inject malicious data through public webhooks. If a workflow accepts external webhook input and uses that data in action nodes—such as updating records or making API calls—an attacker can manipulate those downstream actions by poisoning the data stream. The attacker essentially tricks the workflow into performing unintended operations, like modifying the wrong records or sending requests using the workflow owner's credentials. This flaw affects versions before 2.25.7 and 2.26.2.

• CVE-2026-56306MEDIUM 6.4

  Capgo versions before 12.128.2 contain a flaw in how they validate a specific HTTP header used to enforce restricted API key permissions. An authenticated attacker can craft malformed, zero, or duplicate values in the x-limited-key-id header to trick the system into ignoring subkey restrictions. Once the restriction is bypassed, the attacker's request runs with the privileges of the main API key instead of the intended limited subkey, potentially granting broader access than intended.

• CVE-2026-56329MEDIUM 6.4

  Capgo versions before 12.128.2 have a namespace collision vulnerability in how preview URLs are parsed. The system decodes double underscores to dots in a way that isn't unique—meaning an attacker can register an app ID with underscores that collides with another tenant's dotted app ID. This causes preview traffic to be misrouted and can deny legitimate users access to their preview environments.

• CVE-2026-56778MEDIUM 6.4

  n8n, a popular workflow automation platform, contains a flaw in its Public API that allows users with read-only access to workflows to trigger re-executions of those workflows. The vulnerability stems from an authorization check that uses the wrong permission scope—it verifies read access when it should verify execute access. This means an authenticated user who should only be able to view a shared workflow can actually run it again, circumventing the intended separation between viewing and executing. The issue affects n8n versions before 2.25.7 and 2.26.x before 2.26.2, particularly in multi-user or cross-project setups where workflows are shared.

• CVE-2026-56779MEDIUM 6.4

  MaxKB versions before 2.10.0 contain a server-side request forgery (SSRF) flaw in their tool management features. An authenticated user with standard workspace permissions can craft malicious requests to make the MaxKB server itself fetch data from internal network locations they specify. This breaks the assumption that authenticated users can only interact with external resources through normal channels, effectively turning the MaxKB server into a proxy for attacking systems behind firewalls or accessing sensitive internal services.

• CVE-2026-5714MEDIUM 6.4

  The Enable Media Replace plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Author-level permissions or higher to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially compromising their accounts, stealing session data, or performing actions on their behalf. The vulnerability exists in all versions up to and including 4.1.8 and results from the plugin's failure to properly sanitize and escape the 'location_dir' parameter.

• CVE-2026-57956MEDIUM 6.4

  SigNoz versions before 0.133.0 contain a flaw in how they enforce access controls for alert rules in multi-tenant deployments. An authenticated user in one organization can view, modify, and delete alert rules belonging to a completely different organization by directly referencing the rule's UUID. This happens because the system fails to verify that the requesting user's organization actually owns the rule before granting access. The vulnerability requires valid login credentials to exploit but does not require special privileges, making it a significant tenant isolation issue.

• CVE-2026-6062MEDIUM 6.4

  Mattermost Server contains an authorization flaw that allows authenticated users to modify notification subscriptions for channels they don't have access to. An attacker with any valid Mattermost account can craft a specially formed request to edit subscription settings on channels outside their permissions, potentially redirecting notifications or modifying channel monitoring rules. The vulnerability affects multiple versions across the 10.11, 11.5, 11.6, and 11.7 release lines and requires an attacker to already have valid authentication credentials to the Mattermost instance.

• CVE-2026-6275MEDIUM 6.4

  The StatCounter – Free Real Time Visitor Stats WordPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated authors to inject malicious scripts into their posts. When any visitor views a post authored by an attacker, the injected script executes in their browser. The vulnerability exists because the plugin fails to properly escape the author's nickname before outputting it into JavaScript code on every post page.

• CVE-2026-6427MEDIUM 6.4

  The a3 Lazy Load WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions through 2.7.6. An attacker with Contributor-level permissions can craft a malicious video element that exploits a regex parsing bug in the plugin's video filtering logic. When this crafted content is viewed by any site user—including administrators—malicious JavaScript executes in their browser. The vulnerability stems from improper quote handling in HTML attribute processing, combined with unescaped output in the admin interface.

• CVE-2026-6459MEDIUM 6.4

  A WordPress plugin called Essential Addons for Elementor has a security flaw in its Event Calendar widget that allows content creators and administrators to inject malicious code into web pages. When visitors view those pages, the injected code runs in their browsers, potentially allowing attackers to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability exists because the plugin doesn't properly clean or escape event titles pulled from The Events Calendar. Only users with Author-level permissions or higher can exploit this, so it requires insider access or a compromised legitimate account.

• CVE-2026-6673MEDIUM 6.4

  Mattermost is vulnerable to an authentication bypass in how it handles Atlassian Connect integration callbacks. During the window when a Jira integration is being installed, an attacker with valid Mattermost user credentials can craft a malicious POST request to trick the system into accepting a fake shared secret. This compromises the trust relationship between Mattermost and Jira, allowing disruption of the integration and potentially enabling further attacks. The vulnerability affects multiple versions across the 10.11, 11.5, 11.6, and 11.7 release lines.

• CVE-2026-6740MEDIUM 6.4

  The Nexter Blocks plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'commentIcon' parameter that affects all versions through 4.7.4. An authenticated attacker with contributor-level or higher permissions can inject malicious JavaScript code that persists in page content. When any user visits an affected page, the injected script executes in their browser, potentially compromising their session, stealing credentials, or performing unauthorized actions on their behalf.

• CVE-2026-6742MEDIUM 6.4

  The Advanced iFrame plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'additional' parameter that allows authenticated users with contributor-level permissions or higher to inject malicious scripts into pages. When other users view those pages, the injected code executes in their browsers, potentially compromising data or sessions. The vulnerability affects all versions up to and including 2026.1 and stems from inadequate input validation and output encoding.

• CVE-2026-6910MEDIUM 6.4

  The Bookero.pl online reservation system plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 2.2. An authenticated user with contributor privileges or higher can embed malicious JavaScript code into pages using the plugin's shortcode attributes. When other users visit those pages, the injected script executes in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability exists because the plugin fails to properly sanitize and escape user input before embedding it directly into JavaScript code.

• CVE-2026-7662MEDIUM 6.4

  The ePaperFlip Publisher plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into pages. When other users view those pages, the injected scripts execute in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability affects all versions up to and including version 1 and stems from the plugin failing to properly filter and escape user input in the 'publicationid' shortcode attribute before inserting it into JavaScript code.

• CVE-2026-7795MEDIUM 6.4

  The Click to Chat – WA Widget plugin for WordPress contains a flaw that allows authenticated users with basic contributor permissions to inject malicious code into pages. When someone clicks the WhatsApp chat button on an affected site, the injected code executes in their browser. The vulnerability stems from improper handling of a shortcode parameter: the plugin escapes user input in a way that works for HTML attributes, but that escaping is later decoded by browsers when the value appears inside a JavaScript function call within an event handler. This creates a window for attackers to break out of the intended string context and run arbitrary JavaScript.

• CVE-2026-7796MEDIUM 6.4

  The EmbedPress WordPress plugin, used for embedding PDFs, videos, and other rich media content, contains a stored cross-site scripting (XSS) vulnerability that allows attackers with contributor-level access to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially allowing attackers to steal credentials, perform unauthorized actions, or compromise user sessions. This affects all versions up to and including 4.5.3.

• CVE-2026-8039MEDIUM 6.4

  The Fancy Testimonials plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in how it handles the 'author' attribute of the testimonial shortcode. An authenticated user with Contributor-level permissions or higher can insert malicious JavaScript into a page through this attribute. That script then executes in the browsers of anyone who visits the affected page. Because the malicious code is permanently stored in the page content, every visitor becomes a potential victim—making this a stored XSS rather than a one-time reflected attack.

• CVE-2026-8351MEDIUM 6.4

  The RTMKit plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its Advanced Heading widget. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript into the 'Background Text' parameter, which gets saved to the database and executes whenever any site visitor loads the affected page. This is a persistence risk because the payload remains embedded in your content until manually removed.

• CVE-2026-8489MEDIUM 6.4

  The Ultimate Member WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its user profile 'about_me' field. Authenticated users with subscriber-level permissions can inject malicious JavaScript code that persists in the database and executes in the browsers of anyone viewing the affected profile or related pages. This is a stored variant, meaning the attack payload remains active until manually removed, creating ongoing exposure for site visitors.

• CVE-2026-8494MEDIUM 6.4

  Permalink Manager Lite, a WordPress plugin, contains a security flaw in its admin interface that allows contributors and higher-level users to embed malicious scripts into post titles. When an administrator later visits the Permalink Manager page, that script executes in their browser. The vulnerability exists in all versions up to 2.5.3.3 and requires an authenticated attacker with at least contributor privileges to exploit.

• CVE-2026-8599MEDIUM 6.4

  MailerPress, a popular WordPress plugin for email marketing and automation, contains a vulnerability that allows attackers with author-level or higher permissions to inject malicious scripts into campaign content. These scripts execute when administrators preview the campaigns in the WordPress dashboard. The vulnerability stems from the plugin not properly filtering user input when storing campaign HTML, nor adequately escaping that content when displaying it. The public-facing preview that customers see is protected by security headers, so the risk is primarily to the WordPress site's admin users rather than to recipients of sent emails.

• CVE-2026-8607MEDIUM 6.4

  The myCred WordPress plugin, used for managing loyalty points, badges, and gamification features, contains a stored cross-site scripting (XSS) vulnerability in its shortcode functionality. An attacker with contributor-level or higher access to WordPress can craft malicious code within a shortcode attribute that will execute in the browsers of all users who visit the affected page. This is a persistent attack—the malicious script remains embedded in the site until removed—rather than a one-time exploitation attempt.

• CVE-2026-8613MEDIUM 6.4

  The aThemes Addons for Elementor plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in multiple widget components. A WordPress contributor or higher-privilege user can inject malicious JavaScript into page settings that will execute in the browsers of any visitor to that page. The vulnerability exists in the Posts Timeline widget and Posts Carousel widget (across its default, Banner, and Modern variants) due to missing input validation on the 'title_tag' setting. The same plugin's Posts List widget correctly implements this validation, indicating the flaw is inconsistently applied across the codebase.

• CVE-2026-8649MEDIUM 6.4

  Progress MOVEit Transfer contains a vulnerability in its Custom Reports module that allows an authenticated user with administrative privileges to inject malicious input into report queries. By crafting specially designed data, an attacker can manipulate how the application processes database queries, potentially leading to unauthorized access to sensitive information or modification of report data. The vulnerability requires high user privileges and interaction to exploit, making it a moderate-risk issue primarily relevant to organizations where administrator accounts may be compromised or where insider threats exist.

• CVE-2026-8677MEDIUM 6.4

  Prime Elementor Addons, a WordPress plugin for building pages with Elementor, has a stored cross-site scripting (XSS) vulnerability that allows contributors and higher-privileged users to inject malicious scripts into pages. When other users view those pages, the injected scripts execute in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability persists through versions up to 1.3.3 because the plugin fails to properly sanitize widget HTML settings before storing them.

• CVE-2026-8841MEDIUM 6.4

  The Extra Settings for RocketChat plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 0.1. A WordPress user with contributor-level permissions or higher can craft a malicious 'title' attribute in the 'rocketchat' shortcode to inject JavaScript code into a page. When other users visit that page, the injected script executes in their browser within the site's context, potentially allowing the attacker to steal credentials, perform actions on their behalf, or deface content.

• CVE-2026-8865MEDIUM 6.4

  The Avalon23 Products Filter for WooCommerce plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated WordPress contributors and higher-privileged users to inject malicious JavaScript into pages via the 'avalon23_qr' shortcode. When other users visit an affected page, the injected script executes in their browsers, potentially compromising their accounts or stealing sensitive data. The vulnerability exists because the plugin fails to properly sanitize and escape user input in shortcode attributes before displaying them in HTML.

• CVE-2026-8880MEDIUM 6.4

  The RomanCart Ecommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its shortcode handler. An authenticated user with contributor permissions or higher can inject malicious JavaScript code into pages through the romancart_button shortcode's attributes. Once injected, that code executes for every visitor who views the affected page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability exists in versions 2.0.8 and earlier due to inadequate input validation and output encoding.

• CVE-2026-8882MEDIUM 6.4

  A WordPress plugin called WP ApplicantStack Jobs Display contains a security flaw that allows certain logged-in users to inject malicious code into web pages. When other users visit those pages, the injected code runs in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability affects all versions up to and including 1.1.1 and requires the attacker to have at least contributor-level permissions on the WordPress site.

• CVE-2026-8883MEDIUM 6.4

  The Global Body Mass Index Calculator WordPress plugin contains a stored cross-site scripting (XSS) flaw affecting versions 1.2 and earlier. Attackers with contributor-level access can inject malicious scripts through the plugin's shortcode functionality. These scripts persist in the database and execute whenever site visitors view affected pages, potentially compromising user sessions, stealing credentials, or spreading malware across your WordPress site.

• CVE-2026-8885MEDIUM 6.4

  The DeMomentSomTres Shortcodes plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'callout' shortcode feature. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code through the 'width' and 'align' shortcode parameters. Because the plugin fails to properly sanitize and escape these inputs, the injected code executes whenever any visitor views the affected page. This creates a persistent threat that compromises site visitors, not just the page editor.