Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,421 results · page 12 of 149
Sep 23, 2026Booking Manager: Does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL queryCVE-2026-91024 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.
- Product
- Booking Manager
- Fixed in
- 2.1.21
- What to do
- Update Booking Manager to 2.1.21 or newer.
Sep 23, 2026JSM Show Post Metadata: Does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta boxCVE-2026-88997 · WordPress plugins & themes · reported by WPScanMedium 6.8
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post.
- Product
- JSM Show Post Metadata
- Fixed in
- 4.9.1
- What to do
- Update JSM Show Post Metadata to 4.9.1 or newer.
Sep 23, 2026Paymob for WooCommerce: Does not perform a capability check on several admin AJAX actions that manage its payment-gateway configurationCVE-2026-87981 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials.
- Product
- Paymob for WooCommerce
- Fixed in
- 4.1.14
- What to do
- Update Paymob for WooCommerce to 4.1.14 or newer.
Sep 23, 2026Real3D Flipbook: Does not perform capability checks on several of its authenticated flipbook management actionsCVE-2026-86842 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.
- Product
- Real3D Flipbook
- Fixed in
- 5.4
- What to do
- Update Real3D Flipbook to 5.4 or newer.
Sep 23, 2026WP Recipe Maker: Does not perform any capability check in one of its AJAX actionsCVE-2026-86602 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes.
- Product
- WP Recipe Maker
- Fixed in
- 10.8.2
- What to do
- Update WP Recipe Maker to 10.8.2 or newer.
Sep 23, 2026HappyAddons for Elementor: Does not escape an icon value on one of its button widgets before outputting it inside an HTML attributeCVE-2026-85006 · WordPress plugins & themes · reported by WPScanMedium 6.8
The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser of anyone who views the page, including higher-privileged users reviewing the content, even though such users do not hold the unfiltered_html capability.
- Product
- HappyAddons for Elementor
- Fixed in
- 3.50.0
- What to do
- Update HappyAddons for Elementor to 3.50.0 or newer.
Sep 23, 2026Events Calendar: Does not perform a per-object capability check on one family of its REST write routesCVE-2026-84743 · WordPress plugins & themes · reported by WPScanLow 3.8
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.
- Product
- Events Calendar
- Fixed in
- 6.17.5
- What to do
- Update Events Calendar to 6.17.5 or newer.
Sep 23, 2026Events Calendar: Does not check the capability required to publish content before creating or updating it through its REST APICVE-2026-84742 · WordPress plugins & themes · reported by WPScanLow 2.7
The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.
- Product
- Events Calendar
- Fixed in
- 6.17.5
- What to do
- Update Events Calendar to 6.17.5 or newer.
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not check user capabilitiesCVE-2026-84027 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.9.5
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Sep 23, 2026zportals: Does not perform any capability or nonce check on one of its AJAX actionsCVE-2026-18365 · WordPress plugins & themes · reported by WPScanMedium 4.3
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators.
- Product
- zportals
- Fixed in
- 6.4.2
- What to do
- Update zportals to 6.4.2 or newer.
Sep 23, 2026zportals: Does not perform any capability or nonce check on several of its AJAX actionsCVE-2026-18364 · WordPress plugins & themes · reported by WPScanMedium 4.3
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings.
- Product
- zportals
- Fixed in
- 6.4.2
- What to do
- Update zportals to 6.4.2 or newer.
Sep 23, 2026Real3D Flipbook: Does not sanitize or escape several flipbook editor fields before rendering them back in the admin editorCVE-2025-15696 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.
- Product
- Real3D Flipbook
- Fixed in
- 5.4
- What to do
- Update Real3D Flipbook to 5.4 or newer.
Sep 23, 2026jet-form-builder-stripe-gateway: Does not sanitise and escape a payment token before using it in a SQL statementCVE-2022-4997 · WordPress plugins & themes · reported by WPScanHigh 8.6
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes.
- Product
- jet-form-builder-stripe-gateway
- Fixed in
- 1.1.0
- What to do
- Update jet-form-builder-stripe-gateway to 1.1.0 or newer.
Sep 22, 2026MISP contains an authorization flaw in the Organisation model's captureOrg method.CVE-2026-95697 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.3
MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions. According to the commit message, this could lead to blueprint-based sharing group manipulation, meaning an attacker with SG editor access could alter organizational attributes in ways that influence how sharing groups and blueprints behave across the MISP instance. The vulnerability requires an authenticated user with at least SG editor privileges and network access to the MISP web interface. The impact is primarily on the integrity of organization records and, potentially, on the integrity of sharing group configurations derived from those records.
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method wCVE-2026-95671 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.3
In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add() method persists data on both POST and PUT requests. As a result, an authenticated user could issue a PUT request to the collections/add endpoint, bypassing the sharing-group authorization check entirely. This allowed the creation of a collection with distribution=4 (shared with a specific sharing group) targeting a sharing group that the user was not authorized to use. The bypassed check would normally verify that the current user has access to the specified sharing group before allowing the collection to be associated with it. The security impact is that an authenticated user can place collection data into a sharing group context they do not have legitimate access to, potentially exposing that data to all members of the unauthorized sharing group and violating the intended access-control boundaries of the MISP instance. The vulnerability requires an authenticated session and knowledge of a valid sharing group identifier; no user interaction or special tooling is needed
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly.CVE-2026-87119 · Other software · ZenHive · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.2
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to the challenge that prompted it. MPP.Methods.Tempo.KeyAuthorization.verify/3 in lib/mpp/methods/tempo/key_authorization.ex pins each of those signed fields against the subscription request, and the access key it pins is a static per-endpoint server key, so one signed authorization verifies against every challenge the server issues for the same subscription terms. MPP.Methods.Tempo.Subscription.activate/4 deduplicates activations by challenge id, so presenting the captured credential under a fresh challenge produces a different dedup key, claim_activation succeeds, and the subscription transaction is built and broadcast again. Each replay charges the payer's wallet a new first-period settlement and re-authorizes the server key, bounded only by the subscription expiry and the chain's own semantics for re-installing an existing key. This issue affects mpp: from 0.14.0 before 0.16.2.
- Product
- mpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Sep 22, 2026The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, whicCVE-2026-92438 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.
- What to do
- Update the plugin to the newest version.
Sep 22, 2026Text Styler: Does not sanitise and escape user-supplied styling values before outputting them within a front-end style blockCVE-2026-88788 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that executes in the browser of anyone viewing the affected post, including administrators.
- Product
- Text Styler
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Text Styler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 21, 2026KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge.CVE-2026-62369 · Other software · kubeedge · reported by GitHubHigh 8.1
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
- Product
- kubeedge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge.CVE-2026-62182 · Other software · kubeedge · reported by GitHubHigh 8.8
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
- Product
- kubeedge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge.CVE-2026-62371 · Other software · kubeedge · reported by GitHubHigh 8.8
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. A user with permission to create or update NodeUpgradeJob resources can supply shell metacharacters in either field, causing arbitrary commands to execute on targeted edge nodes with the privileges of the upgrade process and compromising node confidentiality, integrity, and availability. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
- Product
- kubeedge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge.CVE-2026-62370 · Other software · kubeedge · reported by GitHubMedium 6.5
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
- Product
- kubeedge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2026An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user cCVE-2026-90817 · Other software · Vanderbilt University · reported by contact@securifera.comCritical 9.8
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.
- Product
- REDCap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2026mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window.CVE-2026-94112 · Other software · mayswind · reported by VulnCheckHigh 7.6
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.
- Product
- ezBookkeeping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2026getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings.CVE-2026-94106 · Other software · james-heinrich · reported by VulnCheckHigh 8.7
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
- Product
- getid3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2026Import and export users and customers: Does not enforce the promote_users capability in its front-end import functionalityCVE-2026-92541 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
- Product
- Import and export users and customers
- Fixed in
- 2.5.2
- What to do
- Update Import and export users and customers to 2.5.2 or newer.
Sep 20, 2026Import and export users and customers: Does not correctly enforce the promote_users capabilityCVE-2026-92540 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
- Product
- Import and export users and customers
- Fixed in
- 2.5.2
- What to do
- Update Import and export users and customers to 2.5.2 or newer.
Sep 20, 2026Meow Gallery: Does not perform a proper capability check or restrict results to the requesting user's own posts before returning post dataCVE-2026-92423 · WordPress plugins & themes · reported by WPScanLow 2.7
The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.
- Product
- Meow Gallery
- Fixed in
- 5.5.5
- What to do
- Update Meow Gallery to 5.5.5 or newer.
Sep 20, 2026Tripzzy: Does not perform any capability or ownership checks on its administrative booking-management actionsCVE-2026-87840 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.
- Product
- Tripzzy
- Fixed in
- 1.5.1
- What to do
- Update Tripzzy to 1.5.1 or newer.
Sep 20, 2026Unlimited Elements For Elementor: Does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through itCVE-2026-85017 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
- Product
- Unlimited Elements For Elementor
- Fixed in
- 2.0.20
- What to do
- Update Unlimited Elements For Elementor to 2.0.20 or newer.
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not check that a user holds its options capability before saving image sizing settingsCVE-2026-81654 · WordPress plugins & themes · reported by WPScanLow 3.1
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.
- Product
- Photo Gallery, Sliders, Proofing and
- Fixed in
- 4.5.0
- What to do
- Update Photo Gallery, Sliders, Proofing and to 4.5.0 or newer.
Sep 20, 2026Master Slider: Does not sanitise and escape some of its shortcode attributes before outputting them in an inline script contextCVE-2026-14844 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed. No fixed version is available. Until one ships, restrict the Contributor role to trusted users, or deactivate the Master Slider WordPress plugin through 3.11.2. Site owners who need to keep it active can block the ms_slider shortcode for roles below Editor, for example with a shortcode-restriction Master Slider WordPress plugin through 3.11.2, which prevents the attack without removing the Master Slider WordPress plugin through 3.11.2.
- Product
- Master Slider
- Affected
- up to 3.11.2
- What to do
- Affects up to 3.11.2. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2026OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member acceCVE-2026-93985 · Other software · Openpanel-dev · reported by VulnCheckCritical 9.4
OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.
- Product
- openpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 19, 2026OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms.CVE-2026-93983 · Other software · Openpanel-dev · reported by VulnCheckMedium 5.3
OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.
- Product
- openpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 19, 2026hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an aCVE-2026-93981 · Other software · honojs · reported by VulnCheckLow 2.3
hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 19, 2026Mailchimp for WooCommerce: Does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routesCVE-2026-92435 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
- Product
- Mailchimp for WooCommerce
- Fixed in
- 6.1.1
- What to do
- Update Mailchimp for WooCommerce to 6.1.1 or newer.
Sep 19, 2026VikRentItems Flexible Rental Management System: Does not sanitise and escape some of its parameters before using them in SQL statementsCVE-2026-88926 · WordPress plugins & themes · reported by WPScanHigh 8.6
The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.
- Product
- VikRentItems Flexible Rental Management System
- Fixed in
- 1.2.4
- What to do
- Update VikRentItems Flexible Rental Management System to 1.2.4 or newer.
Sep 19, 2026Ultimate Member: Does not escape a value derived from user supplied profile names before outputting it in the page titleCVE-2026-85680 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.
- Product
- Ultimate Member
- Fixed in
- 2.13.1
- What to do
- Update Ultimate Member to 2.13.1 or newer.
Sep 19, 2026Estatik Real Estate: Does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX responseCVE-2026-76790 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.
- Product
- Estatik Real Estate
- Fixed in
- 4.3.5
- What to do
- Update Estatik Real Estate to 4.3.5 or newer.
Sep 19, 2026Business Name Generator: Does not sanitise and escape some of its settingsCVE-2025-15698 · WordPress plugins & themes · reported by WPScanLow 3.5
The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Business Name Generator
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Business Name Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 18, 2026SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting.CVE-2026-93923 · Other software · siyuan-note · reported by VulnCheckHigh 8.6
SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron rCVE-2026-93922 · Other software · siyuan-note · reported by VulnCheckHigh 8.6
SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Capsule is a multi-tenancy and policy-based framework for Kubernetes.CVE-2026-61795 · Other software · projectcapsule · reported by GitHubMedium 6.8
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7.
- Product
- capsule
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Capsule is a multi-tenancy and policy-based framework for Kubernetes.CVE-2026-61794 · Other software · projectcapsule · reported by GitHubMedium 6.8
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.
- Product
- capsule
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Capsule is a multi-tenancy and policy-based framework for Kubernetes.CVE-2026-61672 · Other software · projectcapsule · reported by GitHubHigh 7.1
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When an administrator's forbidden list mixes capitalized and lowercase keys or otherwise has different case-insensitive and byte ordering, the binary search can return false for a key that is present. An authenticated tenant owner can then pass the missed key through api.ValidateForbidden and bypass configured namespace, Service, or delegated node metadata restrictions, potentially influencing cluster policies, network exposure, or scheduling outside the tenant boundary. Uniformly lowercase lists whose two orderings coincide are not affected. This issue is fixed in version 0.13.7.
- Product
- capsule
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views.CVE-2026-93659 · Other software · concretecms-community-store · reported by VulnCheckHigh 8.6
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.
- Product
- community_store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`.CVE-2026-93606 · Other software · patriksimek · reported by VulnCheckCritical 10
vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer (hostPromiseSanitizeReject / makeSanitizedPromiseCallback / normalizeHostPromiseCallbacks in lib/bridge.js) only wraps `then`/`catch` rejection slots that hold a function, and the sandbox-side `Symbol.species`/`.then` neutralization is installed only on the sandbox intrinsic `Promise.prototype`, so it never applies to a host Promise. Code running inside the sandbox can overwrite `p.constructor[Symbol.species]` on the host Promise and then call `p.then()` with no `onRejected` handler; V8 substitutes its internal Thrower, which re-throws the raw host rejection value into a resolve/reject closure captured by the attacker. This delivers an unsanitized, fully functional bridge proxy of the host object to sandboxed code, bypassing handleException and hostPromiseSanitizeReject. If the rejection value is host-pivotable (for example a host `process` object), this results in arbitrary code execution on the host. Fixed in 3.12.1.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 18, 2026vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-sCVE-2026-93605 · Other software · patriksimek · reported by VulnCheckCritical 10
vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 18, 2026An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7CVE-2026-13684 · Network & remote access · Synology · reported by security@synology.comCritical 9.8
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- Product
- DiskStation Manager (DSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 aCVE-2026-13635 · Network & remote access · Synology · reported by security@synology.comMedium 5.3
An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.
- Product
- DiskStation Manager (DSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.