Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
331,678 results · page 28 of 6634
Nov 6, 2026The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it.CVE-2026-65022 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 6.3
The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it. Injected HTML can be displayed to users who view the preview, which may allow cross-site scripting (XSS) when a user interacts with the crafted content.
- Product
- BigFix MCM & Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 6, 2026WCFM Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39744 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Stored XSS.This issue affects WCFM Membership: from n/a through 2.12.0.
- Product
- WCFM Membership
- Affected
- up to 2.12.0
- What to do
- Affects up to 2.12.0. Update WCFM Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memory allocation, potenCVE-2026-121824 · Other software · LY Corporation · reported by dl_cve@linecorp.comHigh 8.7
A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memory allocation, potentially resulting in denial of service.
- Product
- Armeria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comline.github.io
Nov 6, 2026A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthenticated attackers to byCVE-2026-121823 · Other software · LY Corporation · reported by dl_cve@linecorp.comHigh 8.7
A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthenticated attackers to bypass path-based access controls and access protected resources.
- Product
- Armeria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comline.github.io
Nov 6, 2026A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting (XSSCVE-2026-121822 · Other software · LY Corporation · reported by dl_cve@linecorp.comLow 2.4
A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting (XSS) when directory listing is enabled and a user views the listing.
- Product
- Armeria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comline.github.io
Nov 6, 2026A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowCVE-2026-121821 · Other software · LY Corporation · reported by dl_cve@linecorp.comMedium 5.3
A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticated victim to read sensitive responses from excluded paths when credentials are enabled and the victim's browser sends authentication credentials.
- Product
- Armeria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comline.github.io
Nov 6, 2026A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-supplied SAML messagCVE-2026-121820 · Other software · LY Corporation · reported by dl_cve@linecorp.comHigh 8.7
A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-supplied SAML messages without limiting the output size before signature validation, allowing an unauthenticated remote attacker to exhaust server memory and cause a denial of service.
- Product
- Armeria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comline.github.io
Nov 6, 2026A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolicCVE-2026-121819 · Other software · LY Corporation · reported by dl_cve@linecorp.comMedium 5.9
A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control plane to cause the xDS client to read files outside configured allowed root directories when a symbolic link inside an allowed directory points outside it. In deployments using a credential injector, header-compatible text secrets may be exposed to an attacker-observable upstream.
- Product
- Armeria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comline.github.io
Nov 6, 2026Quick Event Manager: Does not verify the authenticity of PayPal payment notifications before marking event registrationsCVE-2026-121636 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.
- Product
- Quick Event Manager
- Fixed in
- 9.19
- What to do
- Update Quick Event Manager to 9.19 or newer.
Nov 6, 2026Order Tracking: Does not verify that a PayPal payment notification was sent to the merchant's accountCVE-2026-121633 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.
- Product
- Order Tracking
- Fixed in
- 3.6.0
- What to do
- Update Order Tracking to 3.6.0 or newer.
Nov 6, 2026HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.CVE-2026-121006 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines. A remote attackercan exhause the CPU with a single request. HTTP::Body version 1.25 limits the size and number of lines in the trailer.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Nov 6, 2026OAuth Single Sign On – SSO (OAuth Client): Incorrect Privilege AssignmentCVE-2026-120844 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.
- Product
- OAuth Single Sign On – SSO (OAuth Client)
- Affected
- up to 7.1.3
- What to do
- Affects up to 7.1.3. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to uploCVE-2026-118423 · WordPress plugins & themes · reported by WPScanCritical 10
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
- What to do
- Update the plugin to the newest version.
Nov 6, 2026MC4WP: Mailchimp for: Does not prevent request-derived values in its dynamic content tags from being processedCVE-2026-118166 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the site owner to have added a request-derived tag to the form content and to embed the form with the block rather than the classic shortcode.
- Product
- MC4WP: Mailchimp for
- Fixed in
- 4.15.0
- What to do
- Update MC4WP: Mailchimp for to 4.15.0 or newer.
Nov 6, 2026A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin).CVE-2026-9797 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 6, 2026A flaw was found in the training-operator.CVE-2026-83494 · Other software · Red Hat · reported by Red Hat
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.
- Product
- Red Hat OpenShift AI (RHOAI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 6, 2026A flaw was found in distributed-workloads.CVE-2026-83493 · Other software · Red Hat · reported by Red HatCritical 9.1
A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN, and its default write token. Consequently, an attacker could exfiltrate these secrets, leading to unauthorized access to the Snyk integration and potential control over the repository.
- Product
- Red Hat OpenShift AI (RHOAI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 6, 2026A flaw was found in D-Bus.CVE-2026-120749 · Other software · Red Hat · reported by Red HatMedium 6.2
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 6, 2026A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution.CVE-2026-97848 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.
- Product
- Red Hat build of Keycloak 26.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 6, 2026A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification.CVE-2026-97367 · Other software · Red Hat · reported by Red HatMedium 6.4
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.
- Product
- Red Hat build of Keycloak 26.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 6, 2026A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution.CVE-2026-96547 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens.
- Product
- Red Hat build of Keycloak 26.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 6, 2026A flaw was found in the token exchange mechanism of Keycloak.CVE-2026-96460 · Other software · Red Hat · reported by Red HatMedium 5.4
A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 6, 2026A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution.CVE-2026-96447 · Other software · Red Hat · reported by Red HatMedium 4.2
A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution. The issue occurs during the validation of stateless access tokens when the original user ID no longer exists. Keycloak incorrectly falls back to using the username to identify the user without verifying if the identity matches the original token subject. This could allow an attacker with an old token to gain access to a newly created service account if it shares the same client ID as a previously deleted one.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 6, 2026A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution.CVE-2026-92856 · Other software · Red Hat · reported by Red HatMedium 4.9
A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution. The issue occurs when Keycloak acts as an intermediary between an upstream identity provider and downstream services. Keycloak fails to respect specific security instructions called ProxyRestrictions in the login messages it receives. This allows a user to log into downstream services even when the original identity provider explicitly forbade further sharing of the login session. As a result, users can bypass security boundaries intended to limit where their identity can be used.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 6, 2026ShopEngine Gutenberg WooCommerce Builder Blocks Addon: Does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actionsCVE-2026-92396 · WordPress plugins & themes · reported by WPScanMedium 6.8
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.
- Product
- ShopEngine Gutenberg WooCommerce Builder Blocks Addon
- Fixed in
- 2.4.4
- What to do
- Update ShopEngine Gutenberg WooCommerce Builder Blocks Addon to 2.4.4 or newer.
Nov 6, 2026Cool Media Filter: Does not perform any capability or nonce checkCVE-2026-87784 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site.
- Product
- Cool Media Filter
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Cool Media Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more: Does not properly escape content it re-emits through its bundled HTML parserCVE-2026-86606 · WordPress plugins & themes · reported by WPScanHigh 7.5
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any visitor viewing them, including logged in administrators.
- Product
- iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
- Fixed in
- 3.13.7
- What to do
- Update iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more to 3.13.7 or newer.
Nov 6, 2026A flaw was found in the Admin REST API of Keycloak, an identity and access management solution.CVE-2026-19688 · Other software · Red Hat · reported by Red HatMedium 6.8
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 6, 2026WCFM Membership: Does not verify that payment was made before completing a paid membershipCVE-2026-12967 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.
- Product
- WCFM Membership
- Fixed in
- 2.12.1
- What to do
- Update WCFM Membership to 2.12.1 or newer.
Nov 6, 2026A flaw was found in the ansible-core user module.CVE-2026-123037 · Other software · Red Hat · reported by Red HatMedium 6.7
A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.
- Product
- Migration Toolkit for Applications 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 6, 2026A flaw was found in the REST Data Panache component of Quarkus.CVE-2026-121837 · Other software · Red Hat · reported by Red HatMedium 4.3
A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response.
- Product
- Exploit Intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 6, 2026All-in-One Video Gallery: Does not escape a video's stored thumbnail URL before outputting it in the admin video listCVE-2026-120408 · WordPress plugins & themes · reported by WPScanHigh 8
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.
- Product
- All-in-One Video Gallery
- Fixed in
- 5.1.0
- What to do
- Update All-in-One Video Gallery to 5.1.0 or newer.
Nov 6, 2026All-in-One Video Gallery: Does not check the typeCVE-2026-119259 · WordPress plugins & themes · reported by WPScanMedium 5.3
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.
- Product
- All-in-One Video Gallery
- Fixed in
- 5.1.0
- What to do
- Update All-in-One Video Gallery to 5.1.0 or newer.
Nov 6, 2026Surfer: Discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credentialCVE-2026-118639 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-level access and above to read the credential and escalate to publishing arbitrary posts and other privileged actions.
- Product
- Surfer
- Fixed in
- 1.8.1.759
- What to do
- Update Surfer to 1.8.1.759 or newer.
Nov 6, 2026AutomatorWP: Does not check that the user completing its Zoom and AWeber integration connections is allowed to do soCVE-2026-118239 · WordPress plugins & themes · reported by WPScanMedium 5.6
The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.
- Product
- AutomatorWP
- Fixed in
- 6.0.7
- What to do
- Update AutomatorWP to 6.0.7 or newer.
Nov 6, 2026PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Does not verify that a user is permitted to read a given post before returning its content through its revision-comparison featureCVE-2026-118188 · WordPress plugins & themes · reported by WPScanMedium 4.3
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a Subscriber, to read the title, content and excerpt of any other user's private, draft, pending, scheduled or trashed post.
- Product
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
- Fixed in
- 4.3.1
- What to do
- Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to 4.3.1 or newer.
Nov 6, 2026PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Does not verify that a user requesting to duplicate or revise a post has access to that specific postCVE-2026-118187 · WordPress plugins & themes · reported by WPScanLow 2.7
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.
- Product
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
- Fixed in
- 4.3.1
- What to do
- Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to 4.3.1 or newer.
Nov 6, 2026PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Does not correctly restrict who may publish contentCVE-2026-118186 · WordPress plugins & themes · reported by WPScanMedium 4.9
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow.
- Product
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
- Fixed in
- 4.3.1
- What to do
- Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to 4.3.1 or newer.
Nov 6, 2026MC4WP: Mailchimp for: Does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site ownerCVE-2026-118167 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.
- Product
- MC4WP: Mailchimp for
- Fixed in
- 4.15.0
- What to do
- Update MC4WP: Mailchimp for to 4.15.0 or newer.
Nov 6, 2026Ever Accounting: Does not restrict the file path supplied to its CSV import routine to an allowed directoryCVE-2026-118045 · WordPress plugins & themes · reported by WPScanHigh 8.7
The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbitrary files on the server, such as wp-config.php, which takes the entire site offline.
- Product
- Ever Accounting
- Fixed in
- 2.3.3
- What to do
- Update Ever Accounting to 2.3.3 or newer.
Nov 6, 2026Static Snapshot: Does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the serverCVE-2026-116533 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.
- Product
- Static Snapshot
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update Static Snapshot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026WHIZZ: Does not validate the password-reset key before updating a user's passwordCVE-2026-115230 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.
- Product
- WHIZZ
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update WHIZZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026GutenKit: Does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published pageCVE-2026-114427 · WordPress plugins & themes · reported by WPScanMedium 6.8
The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.
- Product
- GutenKit
- Fixed in
- 2.5.5
- What to do
- Update GutenKit to 2.5.5 or newer.
Nov 6, 2026GS JWT Authentication for WP REST API: Does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routesCVE-2026-113615 · WordPress plugins & themes · reported by WPScanCritical 9.8
The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.
- Product
- GS JWT Authentication for WP REST API
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update GS JWT Authentication for WP REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026Advanced Custom Fields (ACF®): Does not properly sanitize a stored field definition that can be modified through its comment handlingCVE-2026-110813 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.
- Product
- Advanced Custom Fields (ACF®)
- Fixed in
- 6.8.11
- What to do
- Update Advanced Custom Fields (ACF®) to 6.8.11 or newer.
Nov 6, 2026MCB: Does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics gridCVE-2026-110525 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.
- Product
- MCB
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update MCB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026A flaw was found in Keycloak.CVE-2026-109081 · Other software · Red Hat · reported by Red HatMedium 6.8
A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 6, 2026A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak.CVE-2026-107124 · Other software · Red Hat · reported by Red HatMedium 6.4
A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak. The issue occurs because the system sets a session cookie based on an unvalidated token hint before completing security checks. An attacker can use this flaw to fix a session ID in a victim's browser, allowing them to hijack the victim's subsequent login and gain full control over their account.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 6, 2026A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace's file share preview functionality.CVE-2026-119432 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 8.7
A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace's file share preview functionality. An attacker could upload a crafted file and share it with a victim. When the victim opens or previews the file, the embedded script executes in the application's origin, potentially accessing locally stored credentials and enabling credential theft.
- Product
- Foxit Workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.CVE-2026-114366 · Other software · qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3Low 2.3
An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.
- Product
- Qt Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodereview.qt-project.orgwiki.qt.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.