Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,139 results · page 5 of 23
May 15, 2026Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-45616 · Other software · givanz · reported by GitHubMedium 5.1
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, This vulnerability is fixed in 1.0.8.3.
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2026Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-44826 · Other software · givanz · reported by GitHubHigh 7.5
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not validate the sign of the quantity parameter on the cart-add endpoint. Submitting a negative integer is accepted by the server and treated as a normal positive line-item, but with the sign carried through into every downstream computation: line total, sub-total, taxes, and grand total all become negative numbers. The customer-facing cart UI then displays a negative grand total to the user, the checkout flow accepts the negative cart, and the resulting order is persisted in the merchant's database with a negative total column. From the merchant's order management dashboard, this surfaces as a real order with a negative total — an "the merchant owes the customer money" record that no legitimate workflow ever creates. This vulnerability is fixed in 1.0.8.2.
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2026Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-44366 · Other software · givanz · reported by GitHubMedium 6.1
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.1, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Vvveb CMS comment submission flow. The author field is submitted by an unauthenticated user on any public post page, stored without sanitization, and later rendered unsanitized in two distinct sinks: This vulnerability is fixed in 1.0.8.1.
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Live Helper Chat is an open-source application that enables live support websites.CVE-2026-44633 · Other software · LiveHelperChat · reported by GitHubHigh 8.1
Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read. The endpoint accepts arbitrary chat object fields, so the user can change the chat hash and status and then access or tamper with the chat through visitor/widget paths. The same write primitive can set operation_admin, which is later emitted as operator-side JavaScript.
- Product
- livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd.CVE-2026-2347 · Websites & servers · Akilli Commerce Software Technologies Ltd. Co. · reported by iletisim@usom.gov.trCritical 9.8
Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking. This issue affects E-Commerce Website: before 4.5.001.
- Product
- E-Commerce Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd.CVE-2025-11024 · Websites & servers · Akilli Commerce Software Technologies Ltd. Co. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Blind SQL Injection. This issue affects E-Commerce Website: before 4.5.001.
- Product
- E-Commerce Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy): Unauthorized access and modification of dataCVE-2026-5371 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability checks on the get_ads_access_token() and reset_experience() functions in all versions up to, and including, 10.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve live Google OAuth access tokens and reset Plugins's Google Ads integration.
- Product
- MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
- Affected
- up to 10.1.2
- What to do
- Affects up to 10.1.2. Update MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 12, 2026AntSword is a cross-platform website management toolkit.CVE-2026-43892 · Other software · AntSwordProject · reported by GitHubHigh 8.8
AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection. This vulnerability is fixed in 2.1.16.
- Product
- antSword
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd.CVE-2025-6577 · Websites & servers · Akilli Commerce Software Technologies Ltd. Co. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows SQL Injection. This issue affects E-Commerce Website: before 4.5.001.
- Product
- E-Commerce Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more.CVE-2026-42603 · Other software · OWASP-BLT · reported by GitHubHigh 8.8
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions. This vulnerability is fixed in 2.1.2.
- Product
- BLT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Emlog is an open source website building system.CVE-2026-42287 · Other software · emlog · reported by GitHubCritical 10
Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction. This issue has been patched in version 2.6.11.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Emlog is an open source website building system.CVE-2026-42286 · Other software · emlog · reported by GitHubHigh 8.4
Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes. This issue has been patched in version 2.6.11.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Emlog is an open source website building system.CVE-2026-41517 · Other software · emlog · reported by GitHubNone
Emlog is an open source website building system. Prior to version 2.6.11, insecure plugin upload functionality allows attackers to upload and execute arbitrary PHP code, leading to complete server compromise and persistent backdoor installation. This issue has been patched in version 2.6.11.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes.CVE-2026-41692 · Other software · i18next · reported by GitHubMedium 4.7
i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (the replaceInside handler) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,<script>...</script> is applied unchanged to the live DOM attribute when an attacker can influence the content of a translation file or the translation-backend response — for example, via a compromised translation CDN, user-contributed locales, a MITM on a plain-HTTP backend, or write access to the translation JSON. This issue was patched in version 4.0.8.
- Product
- i18nextify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without sCVE-2026-41691 · Other software · i18next · reported by GitHubMedium 6.5
Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation, or path sanitisation. When an application exposes the language-code selection to user-controlled input (the default — i18next-browser-languagedetector reads ?lng= query params, cookies, localStorage, and request headers), an attacker can inject characters that change the structure of the outgoing request URL. This is a single URL-injection vulnerability. The attacker-controlled value is neutralised before it is used as part of an output URL string; the attack shape covers both path traversal and broader URL-structure injection — both are closed by the one interpolateUrl sanitisation fix. This issue has been fixed in version 3.0.5. If users cannot upgrade immediately, they can work around the issue by sanitising lng / ns before they reach i18next (strip .., /, \, ?, #, %, whitespace, and control characters; cap the length).
- Product
- i18next-http-backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website: Stored Cross-Site ScriptingCVE-2026-4730 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'chartid' shortcode attribute in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 2, 2026A vulnerability was detected in pskill9 website-downloader up to 0.1.0.CVE-2026-7642 · Other software · pskill9 · reported by VulDBLow 2.1
A vulnerability was detected in pskill9 website-downloader up to 0.1.0. This affects the function download_website of the file src/index.ts of the component MCP Interface. Performing a manipulation of the argument outputPath results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- website-downloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026Elementor Website Builder: Stored Cross-Site ScriptingCVE-2026-6127 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _elementor_data meta field in versions up to, and including, 4.0.4. This is due to insufficient input sanitization when processing form-encoded REST API requests. The plugin registers the _elementor_data meta field with show_in_rest but omits a sanitize_callback, relying instead on a rest_pre_insert_post filter (sanitize_post_data function) that only sanitizes JSON-encoded request bodies. When a contributor sends a form-encoded PATCH request to the WordPress REST API, the json_decode() call on the raw body returns null, causing all sanitization to be skipped. The unsanitized data is then stored via update_post_meta() and later output without escaping through multiple widget sinks including the HTML widget's print_unescaped_setting() function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Elementor Website Builder
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 29, 2026WP Meteor Website Speed Optimization Addon: Stored Cross-Site ScriptingCVE-2026-2902 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frontend_rewrite' function's 'WPMETEOR[N]WPMETEOR' placeholder content in all versions up to, and including, 3.4.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Meteor Website Speed Optimization Addon
- Affected
- up to 3.4.16
- What to do
- Affects up to 3.4.16. Update WP Meteor Website Speed Optimization Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 25, 2026A vulnerability was determined in KLiK SocialMediaWebsite up to 1.0.1.CVE-2026-7002 · Other software · KLiK · reported by VulDBMedium 6.9
A vulnerability was determined in KLiK SocialMediaWebsite up to 1.0.1. This vulnerability affects unknown code of the file /includes/get_message_ajax.php of the component Private Message Handler. Executing a manipulation of the argument c_id can lead to sql injection. It is possible to launch the attack remotely.
- Product
- SocialMediaWebsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin): Unauthorized arbitrary plugin installation and activationCVE-2026-5464 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation in all versions up to, and including, 9.1.2. This is due to the reports page exposing the 'onboarding_key' transient to any user with the 'exactmetrics_view_dashboard' capability. This key is the sole authorization gate for the '/wp-json/exactmetrics/v1/onboarding/connect-url' REST endpoint, which returns a one-time hash (OTH) token. This OTH token is then the only credential checked by the 'exactmetrics_connect_process' AJAX endpoint — which has no capability check, no nonce verification, and accepts an arbitrary plugin ZIP URL via the file parameter for installation and activation. This makes it possible for authenticated attackers, with Editor-level access and above granted the report viewing permission, to install and activate arbitrary plugins from attacker-controlled URLs, leading to Remote Code Execution.
- Product
- ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
- Affected
- up to 9.1.2
- What to do
- Affects up to 9.1.2. Update ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 22, 2026Gallagher Website Design: Stored Cross-Site ScriptingCVE-2026-1913 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gallagher Website Design plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's login_link shortcode in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on the 'prefix' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Gallagher Website Design
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Gallagher Website Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 21, 2026LinkAce is a self-hosted archive to collect website links.CVE-2026-40905 · Other software · Kovah · reported by GitHubHigh 8.1
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, a password reset poisoning vulnerability was identified in the application due to improper trust of user-controlled HTTP headers. The application uses the X-Forwarded-Host header when generating password reset URLs. By manipulating this header during a password reset request, an attacker can inject an attacker-controlled domain into the reset link sent via email. As a result, the victim receives a password reset email containing a malicious link pointing to an attacker-controlled domain. When the victim clicks the link, the password reset token is transmitted to the attacker-controlled server. An attacker can capture this token and use it to reset the victim’s password, leading to full account takeover. This vulnerability is fixed in 2.5.4.
- Product
- LinkAce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to systCVE-2026-31019 · Other software · Dolibarr · reported by MITREHigh 8.8
In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code execution with the ability to execute arbitrary operating system commands on the server.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parametersCVE-2026-31018 · Other software · Dolibarr · reported by MITREHigh 8.8
In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026Website LLMs.txt: Stored Cross-Site ScriptingCVE-2026-6712 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Website LLMs.txt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Website LLMs.txt
- Affected
- up to 8.2.6
- What to do
- Affects up to 8.2.6. Update Website LLMs.txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 21, 2026Website LLMs.txt: Reflected Cross-Site ScriptingCVE-2026-6711 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.6. This is due to the use of filter_input() without a sanitization filter and insufficient output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.
- Product
- Website LLMs.txt
- Affected
- up to 8.2.6
- What to do
- Affects up to 8.2.6. Update Website LLMs.txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 16, 2026Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX: Unauthorized modification of dataCVE-2026-0718 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ultp_shareCount_callback() function in all versions up to, and including, 5.0.5. This makes it possible for unauthenticated attackers to modify the share_count post meta for any post, including private or draft posts.
- Product
- Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX
- Affected
- up to 5.0.5
- What to do
- Affects up to 5.0.5. Update Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 15, 2026OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more.CVE-2026-40316 · Other software · OWASP-BLT · reported by GitHubHigh 8.8
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Versions prior to 2.1.1 contain an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. The workflow uses the pull_request_target trigger to run with full GITHUB_TOKEN write permissions, copies attacker-controlled files from untrusted pull requests into the trusted runner workspace via git show, and then executes python manage.py makemigrations, which imports Django model modules including attacker-controlled website/models.py at runtime. Any module-level Python code in the attacker's models.py is executed during import, enabling arbitrary code execution in the privileged CI environment with access to GITHUB_TOKEN and repository secrets. The attack is triggerable by any external contributor who can open a pull request, provided a maintainer applies the regenerate-migrations label, potentially leading to secret exfiltration, repository compromise, and supply chain attacks. A patch for this issue is expected to be released in version 2.1.1.
- Product
- BLT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database.CVE-2026-39387 · Other software · BoidCMS · reported by GitHubHigh 7.2
BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion (LFI) attack via the tpl parameter, which can lead to Remote Code Execution (RCE).The application fails to sanitize the tpl (template) parameter during page creation and updates. This parameter is passed directly to a require_once() statement without path validation. An authenticated administrator can exploit this by injecting path traversal sequences (../) into the tpl value to escape the intended theme directory and include arbitrary files — specifically, files from the server's media/ directory. When combined with the file upload functionality, this becomes a full RCE chain: an attacker can first upload a file with embedded PHP code (e.g., disguised as image data), then use the path traversal vulnerability to include that file via require_once(), executing the embedded code with web server privileges. This issue has been fixed in version 2.1.3.
- Product
- BoidCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scripts into the websiteCVE-2026-5754 · Other software · Radware · reported by cret@cert.orgMedium 6.1
Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scripts into the website, potentially leading to unauthorized actions, data theft, or other malicious activities.
- Product
- Alteon vADC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordradware.comkb.cert.org
Apr 13, 2026Pachno 1.0.6 contains an open redirection vulnerability that allows attackers to redirect users to arbitrary external websites by manipulating the return_to parCVE-2026-40039 · Other software · Pachno · reported by VulnCheckHigh 7.1
Pachno 1.0.6 contains an open redirection vulnerability that allows attackers to redirect users to arbitrary external websites by manipulating the return_to parameter. Attackers can craft malicious login URLs with unvalidated return_to values to conduct phishing attacks and steal user credentials.
- Product
- Pachno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.comzeroscience.mk
Apr 8, 2026Beaver Builder Page Builder – Drag and Drop Website Builder: Stored Cross-Site ScriptingCVE-2026-2481 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'settings[js]' parameter in versions up to, and including, 2.10.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Beaver Builder Page Builder – Drag and Drop Website Builder
- Affected
- up to 2.10.1.1
- What to do
- Affects up to 2.10.1.1. Update Beaver Builder Page Builder – Drag and Drop Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwpbeaverbuilder.com
Apr 8, 2026Mailercloud – Integrate webforms and synchronize website contacts: Missing AuthorizationCVE-2026-39713 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in mailercloud Mailercloud – Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize-contacts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mailercloud – Integrate webforms and synchronize website contacts: from n/a through <= 1.0.7.
- Product
- Mailercloud – Integrate webforms and synchronize website contacts
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Mailercloud – Integrate webforms and synchronize website contacts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 7, 2026Elementor Website Builder – More Than Just a Page Builder: Stored Cross-Site ScriptingCVE-2025-14732 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in all versions up to, and including, 3.35.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Elementor Website Builder – More Than Just a Page Builder
- Affected
- up to 3.35.5
- What to do
- Affects up to 3.35.5. Update Elementor Website Builder – More Than Just a Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 7, 2026LinkAce is a self-hosted archive to collect website links.CVE-2026-35516 · Other software · Kovah · reported by GitHubMedium 5
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP. The links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. This vulnerability is fixed in 2.5.4.
- Product
- LinkAce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2026News Website Script 2.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code thrCVE-2019-25668 · Websites & servers · Phpscriptsmall · reported by VulnCheckHigh 8.8
News Website Script 2.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the news ID parameter. Attackers can send GET requests to index.php/show/news/ with malicious SQL statements to extract sensitive database information.
- Product
- News Website Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpscriptsmall.comexploit-db.com
Apr 3, 2026Emlog is an open source website building system.CVE-2026-34788 · Other software · emlog · reported by GitHubMedium 6.5
Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tag_model.php at line 168. The updateTagName() function directly interpolates user input into the SQL query string without using parameterized queries or proper escaping ($this->db->escape_string()), making it vulnerable to SQL injection attacks. At time of publication, there are no publicly available patches.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Emlog is an open source website building system.CVE-2026-34787 · Other software · emlog · reported by GitHubMedium 6.5
Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php at line 80. The $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. If the CSRF token check can be bypassed (see potential bypass conditions), an attacker can include arbitrary PHP files from the server filesystem, leading to code execution. At time of publication, there are no publicly available patches.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Emlog is an open source website building system.CVE-2026-34607 · Other software · emlog · reported by GitHubHigh 7.2
Emlog is an open source website building system. In versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip() function (include/lib/common.php:793). When extracting ZIP archives (plugin/template uploads, backup imports), the function calls $zip->extractTo($path) without sanitizing ZIP entry names. An authenticated admin can upload a crafted ZIP containing entries with ../ sequences to write arbitrary files to the server filesystem, including PHP webshells, achieving Remote Code Execution (RCE). At time of publication, there are no publicly available patches.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Emlog is an open source website building system.CVE-2026-34229 · Other software · emlog · reported by GitHubMedium 6.1
Emlog is an open source website building system. Prior to version 2.6.8, there is a stored cross-site scripting (XSS) vulnerability in emlog comment module via URI scheme validation bypass. This issue has been patched in version 2.6.8.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Emlog is an open source website building system.CVE-2026-34228 · Other software · emlog · reported by GitHubHigh 8.7
Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQL and ZIP URLs via GET parameters. The server first downloads and executes the SQL file, then downloads the ZIP file and extracts it directly into the web root directory. This process does not validate a CSRF token. Therefore, an attacker only needs to trick an authenticated administrator into visiting a malicious link to achieve arbitrary SQL execution and arbitrary file write. This issue has been patched in version 2.6.8.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026Ibtana – WordPress Website Builder: Stored Cross-Site ScriptingCVE-2026-1834 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ive' shortcode in all versions up to, and including, 1.2.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ibtana – WordPress Website Builder
- Affected
- up to 1.2.5.7
- What to do
- Affects up to 1.2.5.7. Update Ibtana – WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 30, 2026baserCMS is a website development framework.CVE-2026-32734 · Other software · baserproject · reported by GitHubHigh 7.1
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag creation. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2026-30940 · Other software · baserproject · reported by GitHubHigh 7.2
baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2026-30880 · Other software · baserproject · reported by GitHubCritical 9.2
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2026-30879 · Other software · baserproject · reported by GitHubMedium 6.9
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a cross-site scripting vulnerability in blog posts. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2026-30878 · Other software · baserproject · reported by GitHubMedium 5.3
baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mail form entries even when the corresponding form is not accepting submissions. This bypasses administrative controls intended to stop form intake and enables spam or abuse via the API. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2026-30877 · Other software · baserproject · reported by GitHubCritical 9.1
baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2026-27697 · Other software · baserproject · reported by GitHubMedium 6.9
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.