Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,341 results · page 2 of 387
Nov 6, 2026Advanced Custom Fields (ACF®): Does not properly sanitize a stored field definition that can be modified through its comment handlingCVE-2026-110813 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.
- Product
- Advanced Custom Fields (ACF®)
- Fixed in
- 6.8.11
- What to do
- Update Advanced Custom Fields (ACF®) to 6.8.11 or newer.
Nov 6, 2026Mail Mage: Does not properly sanitise and escape a user-supplied value before using it in a SQL statementCVE-2026-110532 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Mail Mage
- Affected
- up to 0.0.25
- What to do
- Affects up to 0.0.25. Update Mail Mage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026MCB: Does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics gridCVE-2026-110525 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.
- Product
- MCB
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update MCB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2026Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer.CVE-2026-110930 · Other software · OpenAI · reported by 8f4f43ab-ba69-4d92-aa1d-d772184d6fb7High 8
Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.
- Product
- Codex Desktop for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026The Symfony HtmlSanitizer component does not apply the media URL policy to the srcset and imagesrcset attributes, allowing values that point to hosts or schemesCVE-2026-121949 · Other software · sensiolabs · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647Low 2.3
The Symfony HtmlSanitizer component does not apply the media URL policy to the srcset and imagesrcset attributes, allowing values that point to hosts or schemes not permitted by allowMediaSchemes() or allowMediaHosts() to bypass it, so that browsers load images from disallowed hosts in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.The srcset attribute on img and source elements and the imagesrcset attribute on link elements are allowed by the sanitizer, but their URL candidates are never validated, so their values are kept verbatim while the same URL in src is dropped. The fixes for CVE-2026-45753 and CVE-2026-48761 extended the same attribute list but did not cover these two attributes. For example, with allowMediaSchemes(['https']) and allowMediaHosts(['trusted.example']), <img srcset="https://evil.example/a.png 1x"> survives sanitization, and the browser fetches the selected candidate as it would fetch src. Candidates with a scheme forbidden by the configuration, such as http, are kept as well. Any application that sanitizes untrusted HTML and relies on the media schemes and hosts allowlists to restrict where images can be loaded from is af
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView.CVE-2026-106714 · Other software · reported by MITRE
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private neCVE-2026-123119 · Other software · sensiolabs · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647Low 2.3
The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. NoPrivateNetworkHttpClient resolves the host of each request and checks the IP before connecting. It caches the result per host, and passes the IP to the decorated client through the resolve option so that the client connects to the exact IP that was checked. The issue is that resolve was only passed on the first lookup of a host: on subsequent requests, the decorated client resolved the host again on its own. An attacker who controls a host's DNS can exploit this with DNS rebinding by answering the first lookup with a public IP, and subsequent lookups with a private IP, so when an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens, for example, when an application fetches several URLs of a repository provided by a user. The check of the primary_ip in the on_progress ca
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026Dokan: Does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment orderCVE-2026-107776 · WordPress plugins & themes · reported by WPScanLow 2.2
The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.
- Product
- Dokan
- Fixed in
- 5.3.3
- What to do
- Update Dokan to 5.3.3 or newer.
Nov 5, 2026The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthCVE-2026-100109 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.
- What to do
- Update the plugin to the newest version.
Nov 5, 2026EWWW Image Optimizer: Does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the pageCVE-2026-91049 · WordPress plugins & themes · reported by WPScanMedium 6.4
The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.
- Product
- EWWW Image Optimizer
- Affected
- up to 8.9.0
- Fixed in
- 8.9.1
- What to do
- Update EWWW Image Optimizer to 8.9.1 or newer.
Nov 5, 2026Essential Real Estate: Does not verify ownership of an invoice before rendering it in one of its AJAX actionsCVE-2026-90967 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
- Product
- Essential Real Estate
- Fixed in
- 5.3.5
- What to do
- Update Essential Real Estate to 5.3.5 or newer.
Nov 5, 2026Essential Real Estate: Does not verifyCVE-2026-90966 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.
- Product
- Essential Real Estate
- Fixed in
- 5.3.5
- What to do
- Update Essential Real Estate to 5.3.5 or newer.
Nov 5, 2026Essential Real Estate: Does not perform a publication-status or authorization check in two of its AJAX actionsCVE-2026-90965 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.
- Product
- Essential Real Estate
- Fixed in
- 5.3.5
- What to do
- Update Essential Real Estate to 5.3.5 or newer.
Nov 5, 2026Essential Real Estate: Does not restrict the recipient of one of its contact email actionsCVE-2026-90964 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.
- Product
- Essential Real Estate
- Fixed in
- 5.3.5
- What to do
- Update Essential Real Estate to 5.3.5 or newer.
Nov 5, 2026Essential Real Estate: Does not perform any authorization or publication-status check in one of its AJAX actionsCVE-2026-90963 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
- Product
- Essential Real Estate
- Fixed in
- 5.3.5
- What to do
- Update Essential Real Estate to 5.3.5 or newer.
Nov 5, 2026YITH WooCommerce Gift Cards: Does not lock or atomically update a gift card's balanceCVE-2026-88814 · WordPress plugins & themes · reported by WPScanLow 3.7
The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.
- Product
- YITH WooCommerce Gift Cards
- Fixed in
- 4.38.1
- What to do
- Update YITH WooCommerce Gift Cards to 4.38.1 or newer.
Nov 5, 2026Community Events: Does not have authorisation or nonce checks in one of its AJAX actionsCVE-2026-86795 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site.
- Product
- Community Events
- Fixed in
- 1.6.0
- What to do
- Update Community Events to 1.6.0 or newer.
Nov 5, 2026WP Event Manager: Does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flowCVE-2026-86442 · WordPress plugins & themes · reported by WPScanHigh 8.2
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.
- Product
- WP Event Manager
- Fixed in
- 3.4.2
- What to do
- Update WP Event Manager to 3.4.2 or newer.
Nov 5, 2026Tutor LMS: Does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quizCVE-2026-85570 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to obtain them before submitting their attempt.
- Product
- Tutor LMS
- Fixed in
- 4.2.0
- What to do
- Update Tutor LMS to 4.2.0 or newer.
Nov 5, 2026FV Flowplayer Video Player: Does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publiclyCVE-2026-85351 · WordPress plugins & themes · reported by WPScanMedium 5
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.5.56.7212
- What to do
- Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Nov 5, 2026FV Flowplayer Video Player: Does not sanitize and escape a user-supplied value before outputting it in a pageCVE-2026-85347 · WordPress plugins & themes · reported by WPScanMedium 6.8
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.5.56.7212
- What to do
- Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Nov 5, 2026FV Flowplayer Video Player: Does not perform authorization or CSRF checks on several of its cloud storage media browser handlersCVE-2026-85346 · WordPress plugins & themes · reported by WPScanMedium 4.3
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.5.56.7212
- What to do
- Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Nov 5, 2026All In One Login: Does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email loginCVE-2026-19256 · WordPress plugins & themes · reported by WPScanCritical 9.8
The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.
- Product
- All In One Login
- Fixed in
- 2.5.0
- What to do
- Update All In One Login to 2.5.0 or newer.
Nov 5, 2026WP Event Manager: Does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend formsCVE-2026-16304 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.
- Product
- WP Event Manager
- Fixed in
- 3.4.2
- What to do
- Update WP Event Manager to 3.4.2 or newer.
Nov 5, 2026WP PageNavi Style: Does not sanitise and escape some of its settingsCVE-2026-109150 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.
- Product
- WP PageNavi Style
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update WP PageNavi Style to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2026CatFolders: Does not have authorisation checks on a folder maintenance actionCVE-2026-107787 · WordPress plugins & themes · reported by WPScanLow 3.1
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.
- Product
- CatFolders
- Fixed in
- 2.5.7
- What to do
- Update CatFolders to 2.5.7 or newer.
Nov 5, 2026CatFolders: Does not properly sanitize and escape a user-controlled sort setting before using it in a SQL queryCVE-2026-107786 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.
- Product
- CatFolders
- Fixed in
- 2.5.7
- What to do
- Update CatFolders to 2.5.7 or newer.
Nov 5, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller statusCVE-2026-107775 · WordPress plugins & themes · reported by WPScanLow 2.7
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.3.3
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.3.3 or newer.
Nov 5, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not use a trusted site-owned sender addressCVE-2026-107774 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers to make the site email its own vendors with the sender spoofed to an address at the site's own domain (such as its administrator), aligned with the domain's own SPF/DKIM.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.3.3
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.3.3 or newer.
Nov 5, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not correctly verify authorizationCVE-2026-107773 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.3.3
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.3.3 or newer.
Nov 5, 2026Car Dealer (Dealership) and Vehicle sales: Does not restrict its unauthenticated single-listing AJAX action to published contentCVE-2026-105971 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.
- Product
- Car Dealer (Dealership) and Vehicle sales
- Affected
- up to 4.73
- What to do
- Affects up to 4.73. Update Car Dealer (Dealership) and Vehicle sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2026Easy Social Icons: Does not sanitise SVG filesCVE-2026-105259 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.
- Product
- Easy Social Icons
- Fixed in
- 4.0.3
- What to do
- Update Easy Social Icons to 4.0.3 or newer.
Nov 5, 2026IVPAY payments: Does not sanitise a value from its payment callback before using it in a SQL statementCVE-2026-100144 · WordPress plugins & themes · reported by WPScanCritical 9.3
The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.
- Product
- IVPAY payments
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update IVPAY payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2026Cloud Blocks: Does not perform any authorisation or sanitisationCVE-2025-15702 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.
- Product
- Cloud Blocks
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Cloud Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2026Easy Social Icons: Does not sanitise and escape some of its settings before outputting them on front-end pagesCVE-2025-15701 · WordPress plugins & themes · reported by WPScanLow 3.5
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.
- Product
- Easy Social Icons
- Fixed in
- 4.0.3
- What to do
- Update Easy Social Icons to 4.0.3 or newer.
Nov 5, 2026STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded.CVE-2026-123011 · Other software · STMicroelectronics · reported by MITREMedium 4.2
STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded.
- Product
- st-mems-android-linux-sensors-hal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys froCVE-2025-71453 · Other software · vtenext · reported by VulnCheckMedium 5.1
vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session.
- Product
- vtenext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0xbro.redblog.sicuranext.com
Nov 4, 2026Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability.CVE-2026-113374 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11High 8.6
Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-based authentication for the instance. A remote client can then authenticate as an existing user, including an administrator, without credentials.
- Product
- Nexus Repository 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Nov 4, 2026Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provideCVE-2026-113373 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11Critical 9.1
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.
- Product
- Nexus Repository 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Nov 4, 2026Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository is added as a member of a group reposiCVE-2026-113368 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11Medium 5.3
Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository is added as a member of a group repository. A user account that has signed in with valid credentials and holds the add or edit privilege on a group repository can add a repository that the account cannot read or browse, and then read the content of that repository through the group. The anonymous user can only do this if an administrator has explicitly granted it that privilege.
- Product
- Nexus Repository 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Nov 4, 2026FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX CREATE_SURFACE PDU, causing an integer wrap CVE-2026-121950 · Other software · FreeRDP · reported by VulnCheckHigh 7.1
FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX CREATE_SURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A malicious RDP server can send a CREATE_SURFACE PDU with width and height 32766 to a connecting client to corrupt heap memory or cause a denial of service.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 4, 2026In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and eitherCVE-2026-119776 · Other software · frrouting · reported by 57a55968-44ac-464c-a794-6ba3baad09c4Medium 6.1
In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3 adjacencies from unexpectedly, distant IPv6 hosts. Proper usage of OSPFv3 authentication trailers (RFC 7166, as is best practice) prevents full exploitation of this issue, though may allow a malicious actor to waste CPU on authentication checks. Note the linked PR #23935 is not sufficient to fix the issue as it only verifies the source address. It is the destination address that must be checked. Required configuration: The OSPFv3 for IPv6 routing protocol must be running (ospf6d process) and in use (enabled globally with "router ospf6" and on specific interfaces with "ipv6 ospf6 area".) Workaround: either: * configure OSPFv3 authentication trailers ("ipv6 ospf6 authentication") * or ensure through firewall configuration that only packets with link-local or multicast destination addresses are accepted on input for IPv6 protocol 89 (OSPF). Note that checking the source address is ins
- Product
- frrouting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository.CVE-2026-110935 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 8.6
The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.
- Product
- PLCnext Engineer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`.CVE-2026-110021 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 6.9
PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy.
- Product
- PLCnext Engineer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated account-selection input in its GINA web interface.CVE-2026-114420 · Other software · SEPPmail AG · reported by vulnerability@ncsc.chMedium 6.9
SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated account-selection input in its GINA web interface. A remote unauthenticated attacker can enumerate email addresses.
- Product
- SEPPmail Secure Email Gateway (SEG)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026VikWidgetsLoader: Does not sanitise or escape several block attributes before outputting them inside HTML attributesCVE-2026-118983 · WordPress plugins & themes · reported by WPScanMedium 6.8
The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.
- Product
- VikWidgetsLoader
- Fixed in
- 1.12.3
- What to do
- Update VikWidgetsLoader to 1.12.3 or newer.
Nov 4, 2026All-in-One Video Gallery: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2026-118783 · WordPress plugins & themes · reported by WPScanMedium 6.8
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- All-in-One Video Gallery
- Fixed in
- 5.0.0
- What to do
- Update All-in-One Video Gallery to 5.0.0 or newer.
Nov 4, 2026Simple Download Monitor: Does not properly check the visibility of the content referenced by one of its shortcodesCVE-2026-118637 · WordPress plugins & themes · reported by WPScanLow 2.7
The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its shortcodes, allowing users with a role as low as Contributor to disclose the title and description of private, draft and other non-public posts.
- Product
- Simple Download Monitor
- Fixed in
- 4.1.3
- What to do
- Update Simple Download Monitor to 4.1.3 or newer.
Nov 4, 2026EventPrime: Does not keep the built-in Pending Review post status non-publicCVE-2026-118523 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.
- Product
- EventPrime
- Fixed in
- 4.3.6.1
- What to do
- Update EventPrime to 4.3.6.1 or newer.
Nov 4, 2026Stape Conversion Tracking: Does not validate the sub-path appended to its same-origin proxy's upstream endpointCVE-2026-118422 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.
- Product
- Stape Conversion Tracking
- Fixed in
- 2.3.11
- What to do
- Update Stape Conversion Tracking to 2.3.11 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.