Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
59,380 results · page 2 of 1188
Oct 30, 2026Refitter is a tool for generating a C# REST API client using the Refit library.CVE-2026-63346 · Other software · christianhelle · reported by GitHubHigh 8.6
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
- Product
- refitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Refitter is a tool for generating a C# REST API client using the Refit library.CVE-2026-63345 · Other software · christianhelle · reported by GitHubHigh 8.6
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.
- Product
- refitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Refitter is a tool for generating a C# REST API client using the Refit library.CVE-2026-63344 · Other software · christianhelle · reported by GitHubHigh 8.6
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <ct>")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
- Product
- refitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol.CVE-2026-63201 · Other software · CESNET · reported by GitHubHigh 7.1
Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.
- Product
- netopeer2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Refitter is a tool for generating a C# REST API client using the Refit library.CVE-2026-63184 · Other software · christianhelle · reported by GitHubHigh 7.1
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote `http(s)` references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative `../` traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1.
- Product
- refitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026ag-psd is a JavaScript library for reading and writing Photoshop Document files.CVE-2026-62297 · Other software · Agamnentzar · reported by GitHubHigh 7.5
ag-psd is a JavaScript library for reading and writing Photoshop Document files. Before the allocation-limit remediation attempt in version 31.0.0, `readPsd()` commits image and layer buffers from attacker-declared PSD geometry before validating the declarations against the actual available data or sane allocation limits. The `psdReader.js` implementation sizes off-heap typed arrays using `width`, `height`, `channels`, `depth` and `per-layer rectangles`, so a tiny PSD declaring enormous geometry can force multi-gigabyte memory allocation before a later bounds error. The reported 52-byte input on Node 24 produced approximately 3.17 GB peak RSS before a RangeError; under memory pressure the process can be terminated before the error can be caught, and concurrent inputs can exhaust memory. Services reading untrusted PSDs are exposed to denial of service. This differs from genuinely large PSD files whose memory demand is proportional to real input content. Version 31.0.0 adds a composite-image allocation limit, but complete coverage of the separately described layer-rectangle allocation path is not established and requires curator residual/scope review.
- Product
- ag-psd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly.CVE-2026-40573 · Other software · MinecAnton209 · reported by GitHubHigh 8.6
NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the `Nova` interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious `.nv` script through the shell permits a local user to execute code with kernel privileges without security checks. The advisory identifies VM initialization in `zig/nova/vm.zig` as the affected component; script execution is not isolated in a restricted Ring 3 privilege domain. This issue is fixed in version 0.25-beta.1.
- Product
- NovumOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who contrCVE-2026-117645 · Other software · phoenixframework · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 5.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributes_escape/1. attributes_escape/1 in lib/phoenix_html.ex escapes attribute values but not attribute names. key_escape/1 passes a binary key through html_escape, which neutralizes quotes and angle brackets but not whitespace, so a key such as x onmouseover ends the attribute and starts a new one. An atom key is only dasherized, so any character passes, including quotes and >. Nested data, aria and phx keys take the same paths. An application is affected when it builds attribute keys from untrusted input and renders them through HEEx <tag {@attrs}>, content_tag/3, or a direct call. Before 3.0.0 the same code lived in Phoenix.HTML.Tag. This issue affects phoenix_html: from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0.
- Product
- phoenix_html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 30, 2026Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers.CVE-2026-78403 · Other software · Thalesgroup · reported by psirt@thalesgroup.comCritical 9.3
Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. It may lead to remote code execution as NT AUTHORITY\SYSTEM. This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.
- Product
- Sentinel Keys Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.thalesgroup.com
Oct 30, 2026Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers.CVE-2026-78402 · Other software · Thalesgroup · reported by psirt@thalesgroup.comHigh 7.3
Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the input message. A local attacker may craft an input and send it to Sentinel Keys Server. It may lead to code execution as NT AUTHORITY\SYSTEM enabling local privilege escalation. This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.
- Product
- Sentinel Keys Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.thalesgroup.com
Oct 30, 2026pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administCVE-2026-116251 · Other software · pgadmin.org · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Low 2.3
pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting it in User Management. A session established before the change, for example on another device or by someone who had obtained the old password or a session cookie, therefore stayed logged in after the change, which is the step a user or administrator takes precisely to cut such access off. It remained usable until it expired. The fix rotates the user's session identifier (fs_uniquifier) whenever the password is changed, so every other session of that user is logged out. The session that made the change is logged in again and keeps its database connections. Saved server passwords, including those for shared servers, are re-encrypted under the new key; any that cannot be decrypted are cleared and the user is told. If re-encryption fails, the sessions are still revoked and the saved passwords are cleared rather than the change failing. This issue affects pgAdmin 4: before 9.19.
- Product
- pgAdmin 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a passCVE-2026-116245 · Other software · pgadmin.org · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 7.1
libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server's Service, or a "service" connection parameter, to one of those entries and connect with its credentials. A PGPASSWORD or PGSERVICE variable set for that account was likewise used by libpq for every connection without a value of its own and passed on to the utilities, and pg_dumpall read a maintenance database name such as "service=..." as a connection string. The fix adds the SERVER_MODE_ALLOWED_SERVICES setting, empty by default: in server mode only a listed service can be used, the servicefile parameter is refused, and PGPASSWORD and PGSERVICE are removed from pgAdmin's environment at startup. The allowlist is checked again on the final connection string, and the pg_dumpall database name is wrapped as a connection string. This issue affects pgAdmin 4: before 9.19.
- Product
- pgAdmin 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login sCVE-2026-115829 · Other software · Delinea · reported by 1443cd92-d354-46d2-9290-d812316ca43aHigh 8.7
In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.
- Product
- Secret Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.CVE-2026-94175 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject anCVE-2026-7004 · Other software · WIT · reported by VulnCheckMedium 5.1
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios.
- Product
- SynApps Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 30, 2026Daptin is a GraphQL/JSON-API headless CMS.CVE-2026-62160 · Other software · daptin · reported by GitHubHigh 8.7
Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAcceptLanguage` without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, even though the internal parser normalizes underscores to hyphens. Long lists of underscore-separated language subtags longer than eight characters bypass the guard. These subtags fail the `len <= 8` length check in `golang.org/x/text/internal/language/parse.go`, causing repeated `gobble` operations to move the entire remaining buffer through `runtime.memmove`. With many invalid subtags, this repeated buffer movement takes quadratic work. Unauthenticated requests to the public landing page or `/api` can consume disproportionate CPU, with a 256 KiB header already causing seconds of processing and larger input permitted by the default 1 MiB header ceiling. `resource.CheckErr` also logs the entire invalid header, amplifying cost, while normal successful HTTP responses can conceal the denial-of-service traffic. Repeated requ
- Product
- daptin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026VoiceSentinel is a real-time voice moderation system for Minecraft servers.CVE-2026-61854 · Other software · jackh54 · reported by GitHubHigh 8.2
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1.
- Product
- VoiceSentinel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.CVE-2026-54855 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.CVE-2026-48201 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.CVE-2026-39786 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.
- Affected
- up to 1.8.33
- What to do
- Affects up to 1.8.33. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Ultimate Addons for Elementor - Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39739 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5.
- Product
- Ultimate Addons for Elementor - Lite
- Affected
- up to 2.9.5
- What to do
- Affects up to 2.9.5. Update Ultimate Addons for Elementor - Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.CVE-2026-28160 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.
- Affected
- up to 1.4.10
- What to do
- Affects up to 1.4.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.CVE-2026-27061 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.
- Affected
- up to 5.3.0
- What to do
- Affects up to 5.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboCVE-2026-120046 · Other software · nezhahq · reported by VulnCheckMedium 6
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.
- Product
- nezha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.CVE-2026-116854 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
- Affected
- up to 8.4.0
- What to do
- Affects up to 8.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.CVE-2026-116851 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.
- Affected
- up to 3.6.5
- What to do
- Affects up to 3.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.CVE-2026-116847 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.CVE-2026-116405 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.CVE-2026-114711 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.
- Affected
- up to 5.0.20
- What to do
- Affects up to 5.0.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.CVE-2026-105077 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.
- Affected
- up to 2.8.19
- What to do
- Affects up to 2.8.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Meow Gallery: Stored Cross-Site ScriptingCVE-2026-9239 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick.
- Product
- Meow Gallery
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update Meow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce: Stored Cross-Site ScriptingCVE-2026-96894 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The inbound email router's only gate is a regex match on the References header for a reply token whose hash is never cryptographically validated, meaning any external party who received or can mimic a CRM outbound email can satisfy the check without a WordPress account.
- Product
- ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
- Affected
- up to 1.17.10
- What to do
- Affects up to 1.17.10. Update ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript inCVE-2026-119764 · Other software · its-a-feature · reported by VulnCheckHigh 7.4
Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.
- Product
- Mythic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to injectCVE-2026-119761 · Other software · Axigen · reported by VulnCheckMedium 5.3
Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display name that executes when the recipient opens the folder, enabling mailbox content theft or redirection.
- Product
- Axigen Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026CP Multi View Events Calendar: Stored Cross-Site ScriptingCVE-2026-119176 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce is localized to any published page carrying the calendar shortcode, making the adddetails endpoint reachable by any authenticated user with Subscriber-level access or above.
- Product
- CP Multi View Events Calendar
- Affected
- up to 1.4.43
- What to do
- Affects up to 1.4.43. Update CP Multi View Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-119113 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (post_content) in versions up to, and including, 2.8.199 This is due to insufficient input sanitization on save (the bundled geodir_kses_safe_embed_attributes() helper only neutralises data-embed-url, data-src and data-embed, while WordPress core wp_kses_post permits data-* attributes on standard HTML tags) combined with the AyeCode UI library initializing every [data-bs-toggle="popover-html"] element with { html: true, sanitize: false }, which inserts the attacker-controlled data-bs-content value into the popover body as HTML at render time. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Affected
- up to 2.8.199
- What to do
- Affects up to 2.8.199. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 30, 2026The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Arbitrary shortcode executionCVE-2026-118635 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Affected
- up to 2.8.198
- What to do
- Affects up to 2.8.198. Update The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 30, 2026Like Button Rating ♥ LikeBtn: Stored Cross-Site ScriptingCVE-2026-116552 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_IP (Client-IP header)' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the site administrator to have disabled the default 'Be GDPR compliant' option, which would otherwise hash stored IP values and neutralize the payload. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
- Product
- Like Button Rating ♥ LikeBtn
- Affected
- up to 2.6.64
- What to do
- Affects up to 2.6.64. Update Like Button Rating ♥ LikeBtn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026Themify Builder: Stored Cross-Site ScriptingCVE-2026-115869 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is 'textbox' or 'textarea', so the 'repeater' field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to update_post_meta() verbatim, and Themify_Custom_Fonts::render_columns() later echoes those values unescaped inside a <style> block on the Custom Fonts admin listing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (specifically, the Custom Fonts admin listing).
- Product
- Themify Builder
- Affected
- up to 7.8.4
- What to do
- Affects up to 7.8.4. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution: Stored Cross-Site ScriptingCVE-2026-112365 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cover_letter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires an administrator to open the affected candidate's Application tab and click the attacker-crafted link, at which point WHATWG URL parsing collapses the encoded scheme back to javascript: and executes the payload.
- Product
- easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution
- Affected
- up to 2.8.4
- What to do
- Affects up to 2.8.4. Update easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026FV Flowplayer Video Player: Stored Cross-Site ScriptingCVE-2026-110533 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have enabled the "Allow visitors to upload videos to their profile" (profile_videos_enable_bio) setting before Subscriber-level users can submit profile videos.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.55.7212
- What to do
- Affects up to 7.5.55.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 30, 2026FV Flowplayer Video Player: Stored Cross-Site ScriptingCVE-2026-110001 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's 'Parse Vimeo and YouTube links' (parse_comments) setting to be enabled by an administrator, which causes the plugin to register do_shortcode on the comment_text filter, allowing attacker-supplied shortcode attributes stored in comments to be rendered unescaped to all subsequent visitors.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.55.7212
- What to do
- Affects up to 7.5.55.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 30, 2026FV Flowplayer Video Player: Stored Cross-Site ScriptingCVE-2026-109984 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled and a site administrator to approve the comment containing the malicious shortcode; execution is then triggered for any visitor who interacts with the video player on that page.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.55.7212
- What to do
- Affects up to 7.5.55.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 30, 2026Independent Analytics Pro: Stored Cross-Site ScriptingCVE-2026-104744 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Independent Analytics Pro build to be active, as the free build nulls campaign parameters; additionally, the attacker must first visit a frontend page to obtain a server-signed payload that can be replayed with a crafted utm_campaign value against the unauthenticated /iawp/search REST endpoint, since the signature check does not cover utm_* fields.
- Product
- Independent Analytics Pro
- Affected
- up to 2.15.5
- What to do
- Affects up to 2.15.5. Update Independent Analytics Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordindependentwp.comwordfence.com
Oct 30, 2026JS Help Desk – AI-Powered Support & Ticketing System: Arbitrary file deletionCVE-2026-104739 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires a two-step sequence: an administrator first saves a traversal-crafted value in the support_custom_img configuration field, then triggers deletion by uploading a new support custom image, at which point setSupportCustomImage() resolves and deletes the attacker-controlled path.
- Product
- JS Help Desk – AI-Powered Support & Ticketing System
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update JS Help Desk – AI-Powered Support & Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026Redux Framework: Stored Cross-Site ScriptingCVE-2026-102918 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API.
- Product
- Redux Framework
- Affected
- up to 4.5.15
- What to do
- Affects up to 4.5.15. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026myTinyWMS is a free, open-source warehouse management system.CVE-2026-61804 · Other software · myTinyWMS · reported by GitHubHigh 8.1
myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, `Product (Artikel)` and `Category` management store the `name` parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including `article/index.blade.php` and `category/index.blade.php`. An authenticated attacker can save malicious input through product creation or category forms. When another user, including a worker or administrator, opens the corresponding product sheet, category listing or dashboard, the stored JavaScript executes in that user's browser context. This can enable cross-user script execution, session theft and administrative takeover. This issue is fixed in version 1.6.4.
- Product
- myTinyWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionaliCVE-2026-37468 · Other software · reported by MITRE
Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality, chat messaging component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Media Player Addons for Elementor – Media Player widget for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-119365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player widget for WP: from n/a through 1.1.10.
- Product
- Media Player Addons for Elementor – Media Player widget for WP
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Media Player Addons for Elementor – Media Player widget for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating CVE-2026-119720 · Other software · Blender Foundation · reported by VulnCheckMedium 6.8
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds read and crashes Blender.
- Product
- Blender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprojects.blender.orgprojects.blender.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.