Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
571 results · page 3 of 12
Jul 1, 2026Visualizer – Tables & Charts Manager with Built-in AI Generator: Authorization bypassCVE-2026-13468 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site — including charts in draft, private, pending, future, or trash status — as CSV, Excel, or HTML via the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpoint. This bypass is particularly impactful because the standard WordPress REST endpoint for the non-public 'visualizer' custom post type correctly enforces capability checks and returns HTTP 401 to unauthenticated callers, whereas this plugin-registered route circumvents that protection entirely.
- Product
- Visualizer – Tables & Charts Manager with Built-in AI Generator
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Visualizer – Tables & Charts Manager with Built-in AI Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2026Invoice Generator: Privilege escalationCVE-2026-12415 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_pravel_invoice_edit_account, accepts an attacker-controlled user_id and user_email from POST data, and calls wp_update_user() without verifying authentication, ownership, or a nonce. This makes it possible for unauthenticated attackers to change the email address of any user, including administrators, and then trigger WordPress's password reset flow to gain access to the targeted account.
- Product
- Invoice Generator
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Invoice Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 26, 2026A flaw was found in KubeVirt's network annotation generator.CVE-2026-13434 · Other software · Red Hat · reported by Red HatMedium 4.9
A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied networkName value is written verbatim into the launcher pod's v1.multus-cni.io/default-network annotation without format validation or sanitization. The only admission check rejects empty strings; no DNS-1123 format validation, JSON detection, or special character rejection is performed. When the ExternalNetResourceInjection Beta feature gate is enabled (off by default, cluster-admin only), the NAD lookup that would otherwise catch malformed names is skipped by design. A tenant with kubevirt.io:edit permissions can inject a JSON-formatted NetworkSelectionElement array specifying an arbitrary namespace, NAD name, static IP address, and MAC address. Multus on the node parses this JSON and attaches the launcher pod to the specified network attachment in any namespace, enabling cross-namespace network access and IP/MAC impersonation on network segments normally segregated from tenant workloads. The ExternalNetResourceInjection feature gate was introduced in KubeVirt v1.8.0 (first shipped in OpenShift Virtualization 4.21).
- Product
- Red Hat OpenShift Virtualization 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jun 25, 2026A flaw was found in the Pen Drive report generator.CVE-2026-13083 · Other software · Red Hat · reported by Red HatMedium 6.9
A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored cross-site scripting (XSS) payload into cluster objects (such as ClusterVersion spec.channel) that executes in the browser of any user who opens the generated HTML report.
- Product
- Pen Drive Powered by Red Hat Lightspeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jun 24, 2026Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, alloCVE-2026-57284 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps.
- Product
- Jenkins Pipeline: Groovy Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Invoice Generator: Account TakeoverCVE-2026-12416 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and performing a loose equality comparison between the supplied `reset_activation_code` POST parameter and the target user's stored `forgot_email` user meta — a check that trivially evaluates to true (`'' == ''`) for any user who has never initiated a forgot-password request, which applies to administrators under normal conditions. This makes it possible for unauthenticated attackers to supply an arbitrary user ID via the `reset_user_id` POST parameter, bypass the activation code check entirely by omitting `reset_activation_code`, and set the target account's password to an attacker-chosen value, enabling full takeover of any account on the site, including administrator accounts.
- Product
- Invoice Generator
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Invoice Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2026When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGCVE-2026-11311 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.6
When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition serverTokens field and the AuthenticationFilter Custom Resource Definition extraAuthArgs field are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these Custom Resource Definitions may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure from the vulnerability trigger itself. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Gateway Fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved.CVE-2026-42089 · Other software · yeoman · reported by GitHubHigh 8.6
Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap. The vulnerable method is installLocalGenerators(), which calls repository.install() directly without prompting the user. This issue has been fixed in version 6.0.0.
- Product
- environment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to triggeCVE-2026-11604 · Other software · OpenVPN · reported by security@openvpn.netMedium 5.6
An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).
- Product
- ovpn-dco-win
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netgithub.com
Jun 1, 2026Memory Corruption when sending random number generator command with insufficient output buffer size.CVE-2025-59614 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory Corruption when sending random number generator command with insufficient output buffer size.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Crawlomatic Multipage Scraper Post Generator: Remote Code ExecutionCVE-2026-9009 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filter_content function. This is due to passing the attacker-supplied 'callback_raw' shortcode attribute directly into call_user_func() with no sanitization or allowlist validation, relying solely on an is_callable() check that permits dangerous PHP built-ins such as system, shell_exec, exec, passthru, and assert. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. An identical sink exists for the 'callback' attribute, providing a second independent vector through the same shortcode.
- Product
- Crawlomatic Multipage Scraper Post Generator
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update Crawlomatic Multipage Scraper Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 27, 2026A highly authenticated attacker can alter the config generator injecting a payload into future created configurations.CVE-2026-40852 · Other software · MB connect line · reported by info@cert.vde.comHigh 7.2
A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value before passing it to an system execute leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- Product
- mbNET/mbNET.rokey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026診断ジェネレータ作成プラグイン (Diagnosis Generator): Stored Cross-Site ScriptingCVE-2026-5293 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc() function. The function is hooked to 'admin_init' and processes theme update requests without verifying user capabilities, allowing any authenticated user (including subscribers) to save malicious JavaScript to theme files. Additionally, the save() function uses stripslashes() which removes WordPress's magic quotes protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in theme files that will execute whenever a user accesses a page containing the diagnosis form shortcode.
- Product
- 診断ジェネレータ作成プラグイン (Diagnosis Generator)
- Affected
- up to 1.4.16
- What to do
- Affects up to 1.4.16. Update 診断ジェネレータ作成プラグイン (Diagnosis Generator) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 15, 2026Podcast Generator 3.1 is vulnerable to persistent cross-site scripting, allowing authenticated attackers to inject malicious scripts by submitting unfiltered JaCVE-2021-47968 · Other software · Podcastgenerator · reported by VulnCheckMedium 5.1
Podcast Generator 3.1 is vulnerable to persistent cross-site scripting, allowing authenticated attackers to inject malicious scripts by submitting unfiltered JavaScript code in the long_description parameter. Attackers can inject script tags through episode creation or editing requests to execute arbitrary JavaScript when other users view the episode details.
- Product
- Podcast Generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpodcastgenerator.netpodcastgenerator.net
May 13, 2026A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_generator.cpp does not pCVE-2026-31156 · Other software · Openplcproject · reported by MITREMedium 6.5
A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_generator.cpp does not perform any validation on the file path parameters passed via the command line. The user-controlled input parameters are directly passed to the underlying file operation functions (fopen/ifstream/ofstream) for file reading and writing. An attacker can exploit this vulnerability by constructing a malicious path to read arbitrary readable files.
- Product
- Openplc V3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Hugo is a static site generator.CVE-2026-44301 · Other software · gohugoio · reported by GitHubMedium 6.2
Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.
- Product
- hugo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation.CVE-2026-42333 · Other software · quarkiverse · reported by GitHubMedium 6.3
Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, the generated authentication filter matches OpenAPI path templates too broadly when deciding whether to attach credentials. A security scheme configured for one operation can therefore be applied to a different same-method operation whose path only partially resembles the protected template, causing bearer tokens, API keys, or basic credentials to be sent to unintended endpoints. This issue has been patched in versions 2.11.1-lts, 2.16.0-lts, and 2.17.0.
- Product
- quarkus-openapi-generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026Kiota is an OpenAPI based HTTP Client code generator.CVE-2026-41134 · Computers, phones & browsers · microsoft · reported by GitHubHigh 7.3
Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission). When malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and inject additional code into generated clients. This issue is only practically exploitable when the OpenAPI description used for generation is from an untrusted source, or a normally trusted OpenAPI description has been compromised/tampered with. Only generating from trusted, integrity-protected API descriptions significantly reduces the risk. To remediate the issue, upgrade Kiota to 1.29.1, 1.31.1, or later and regenerate/refresh existing generated clients as a precaution. Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output.
- Product
- kiota
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026The `/registercrd` endpoint in KubePlus 4.14 in the kubeconfiggenerator component is vulnerable to command injection.CVE-2026-29955 · Other software · Cloudark · reported by MITREHigh 8.8
The `/registercrd` endpoint in KubePlus 4.14 in the kubeconfiggenerator component is vulnerable to command injection. The component uses `subprocess.Popen()` with `shell=True` parameter to execute shell commands, and the user-supplied `chartName` parameter is directly concatenated into the command string without any sanitization or validation. An attacker can inject arbitrary shell commands by crafting a malicious `chartName` parameter value.
- Product
- Kubeplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 10, 2026Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation.CVE-2026-40180 · Other software · quarkiverse · reported by GitHubHigh 7.7
Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip() method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as new File(toOutputDir, entry.getName()) and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., ../../malicious.java) would write files outside the target directory. This vulnerability is fixed in 2.16.0 and 2.15.0-lts.
- Product
- quarkus-openapi-generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Hugo is a static site generator.CVE-2026-35166 · Other software · gohugoio · reported by GitHubMedium 5.3
Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2.
- Product
- hugo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to pCVE-2026-22662 · Other software · f · reported by VulnCheckMedium 5.3
prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests to the /api/media-generate endpoint to probe internal networks, access internal services, and exfiltrate data through the upstream Wiro service without receiving direct response bodies.
- Product
- prompts.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).CVE-2026-25835 · Computers, phones & browsers · ARM · reported by MITREHigh 7.7
Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).
- Product
- Mbed TLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmbed-tls.readthedocs.iombed-tls.readthedocs.io
Mar 30, 2026In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands.CVE-2026-30308 · Other software · Presidio · reported by MITRECritical 9.8
In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution.
- Product
- HAI Build
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition CVE-2026-29954 · Other software · Cloudark · reported by MITREHigh 7.6
In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to download charts, the chartURL is directly concatenated into the command, allowing attackers to inject wget's `--header` option to achieve arbitrary HTTP header injection.
- Product
- Kubeplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 6, 2026jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor.CVE-2026-29062 · Other software · FasterXML · reported by GitHubHigh 8.7
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint (default: 500) defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive nesting, which can cause a StackOverflowError when the structure is processed, leading to a Denial of Service (DoS). This issue has been patched in version 3.1.0.
- Product
- jackson-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator.CVE-2024-57854 · Other software · DOUGDUDE · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions.
- Product
- Net::NSCA::Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgpatch-diff.githubusercontent.com
Mar 2, 2026AI ChatBot with ChatGPT and Content Generator by AYS: Unauthorized access and modification of dataCVE-2026-1336 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the store_data() and get_chatgpt_api_key() functions in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to view, modify or delete the plugin's ChatGPT API key. The vulnerability was partially fixed in version 2.7.5 and fully fixed in version 2.7.6
- Product
- AI ChatBot with ChatGPT and Content Generator by AYS
- Affected
- up to 2.7.5
- Fixed in
- 2.7.5
- What to do
- Update AI ChatBot with ChatGPT and Content Generator by AYS to 2.7.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 20, 2026Simple Archive Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68880 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Reflected XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
- Product
- Simple Archive Generator
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026AI ChatBot with ChatGPT and Content Generator by AYS: Missing AuthorizationCVE-2026-25338 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.7.4.
- Product
- AI ChatBot with ChatGPT and Content Generator by AYS
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update AI ChatBot with ChatGPT and Content Generator by AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026iXML – Google XML sitemap generator: Reflected Cross-Site ScriptingCVE-2025-14076 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The iXML – Google XML sitemap generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'iXML_email' parameter in all versions up to, and including, 0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- iXML – Google XML sitemap generator
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update iXML – Google XML sitemap generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 11, 2026Orbisius Random Name Generator: Stored Cross-Site ScriptingCVE-2026-1893 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Orbisius Random Name Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_label' parameter in the 'orbisius_random_name_generator' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Orbisius Random Name Generator
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Orbisius Random Name Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 6, 20263DP-MANAGER is an inbound generator for 3x-ui.CVE-2026-25803 · Other software · denpiligrim · reported by GitHubCritical 9.8
3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials (admin/admin) upon the first initialization. Attackers with network access to the application's login interface can gain full administrative control, managing VPN tunnels and system settings. This issue will be patched in version 2.0.2.
- Product
- 3dp-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026OrcaStatLLM Researcher is an LLM Based Research Paper Generator.CVE-2026-24903 · Other software · AlgoNetLab · reported by GitHubMedium 5.3
OrcaStatLLM Researcher is an LLM Based Research Paper Generator. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Log Message in the Session Page in OrcaStatLLM-Researcher that allows attackers to inject and execute arbitrary JavaScript code in victims' browsers through malicious research topic inputs.
- Product
- OrcaStatLLM-Researcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Extended Random Number Generator: Stored Cross-Site ScriptingCVE-2026-0681 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Extended Random Number Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Extended Random Number Generator
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Extended Random Number Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 28, 2026A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTMLCVE-2025-70336 · Other software · Podcastgenerator · reported by MITREMedium 4.8
A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTML via the 'TITLE', 'SHORT DESCRIPTION' and 'LONG DESCRIPTION' parameters. The saved payload gets executed on 'View All Live Items' and 'Live Stream' pages.
- Product
- Podcast Generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for heaCVE-2026-1299 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Flex QR Code Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24614 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Devsbrain Flex QR Code Generator flex-qr-code-generator allows DOM-Based XSS.This issue affects Flex QR Code Generator: from n/a through <= 1.2.10.
- Product
- Flex QR Code Generator
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update Flex QR Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Ai Image Alt Text Generator for WP: Missing AuthorizationCVE-2026-24579 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.9.
- Product
- Ai Image Alt Text Generator for WP
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2026DK PDF – WordPress PDF Generator: Server-Side Request ForgeryCVE-2025-14793 · WordPress plugins & themes · reported by WordfenceMedium 5
The DK PDF – WordPress PDF Generator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3.0 via the 'addContentToMpdf' function. This makes it possible for authenticated attackers, author level and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- DK PDF – WordPress PDF Generator
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update DK PDF – WordPress PDF Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 9, 2026Contact Form vCard Generator: Unauthorized access of dataCVE-2025-13717 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Contact Form vCard Generator plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wp_gvccf_check_download_request' function in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to export sensitive Contact Form 7 submission data via the 'wp-gvc-cf-download-id' parameter, including names, phone numbers, email addresses, and messages.
- Product
- Contact Form vCard Generator
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Contact Form vCard Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 31, 2025Featured Image Generator: Missing AuthorizationCVE-2025-62747 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Aum Watcharapon Featured Image Generator featured-image-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image Generator: from n/a through <= 1.3.4.
- Product
- Featured Image Generator
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Featured Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One: Missing AuthorizationCVE-2025-62154 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in recorp AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One ai-content-writing-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One: from n/a through <= 1.1.7.
- Product
- AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Serial Codes Generator and Validator with WooCommerce Support: Missing AuthorizationCVE-2025-62091 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Vollstart Serial Codes Generator and Validator with WooCommerce Support serial-codes-generator-and-validator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serial Codes Generator and Validator with WooCommerce Support: from n/a through <= 2.8.2.
- Product
- Serial Codes Generator and Validator with WooCommerce Support
- Affected
- up to 2.8.2
- What to do
- Affects up to 2.8.2. Update Serial Codes Generator and Validator with WooCommerce Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Simple Archive Generator: Cross-Site Request Forgery (CSRF)CVE-2025-49346 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Stored XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
- Product
- Simple Archive Generator
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 22, 2025Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.CVE-2025-26379 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.2
Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.
- Product
- IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 17, 2025PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible through the podcast details interface (podcastCVE-2023-53920 · Other software · Podcastgenerator · reported by VulnCheckMedium 5.1
PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible through the podcast details interface (podcast_details.php). Malicious JavaScript payloads injected into the podcast title execute when users visit the application's home page.
- Product
- PodcastGenerator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpodcastgenerator.netexploit-db.com
Dec 17, 2025PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible through the theme customization interface (tCVE-2023-53919 · Other software · Podcastgenerator · reported by VulnCheckMedium 5.1
PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible through the theme customization interface (theme_freebox.php). Malicious JavaScript payloads injected into the Freebox content execute when users visit the application's home page.
- Product
- PodcastGenerator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpodcastgenerator.netexploit-db.com
Dec 17, 2025PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the episode title field accessible through the episodes upload interface (episodeCVE-2023-53918 · Other software · Podcastgenerator · reported by VulnCheckMedium 5.1
PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the episode title field accessible through the episodes upload interface (episodes_upload.php). Malicious JavaScript payloads injected into episode titles execute when administrators view the episodes list page (episodes_list.php).
- Product
- PodcastGenerator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpodcastgenerator.netexploit-db.com
Dec 16, 2025PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form.CVE-2023-53899 · Other software · Podcastgenerator · reported by VulnCheckMedium 5.1
PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the 'shortdesc' parameter to trigger external HTTP requests to arbitrary endpoints during podcast episode creation.
- Product
- PodcastGenerator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compodcastgenerator.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.