WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate FAQ versions = 2.4.14...

CVE-2026-75825

ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability...

WordPress: Information Disclosure - Unauthen Leak Private Content

A vulnerability was discovered in the BuddyPress integration of a forum plugin where the hidesitewide flag for new topic and reply activity was computed by checking only the posting forum's own status, not its parent forums. This allowed topics posted in a public-status subforum nested under a...

WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay Payment Button versions = 2.4.9...

CVE-2026-75825 Authentication Bypass vulnerability

ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability...

EUVD-2026-85271

ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability...

CVE-2026-75825

ZohoCorp ManageEngine OpManager versions 12.8.710 and below are affected by an Authentication Bypass vulnerability when the Application Manager Plugin is enabled. Exploitation of this flaw could allow an attacker to bypass security controls. No specific root cause, exploit details, or remediation...

CVE-2026-75825 Authentication Bypass vulnerability

ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability...

WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin WP Photo Album Plus versions = 9.3.02.002...

CVE-2026-95627

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution XSS can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no...

@crabnebula/taurify-api (>=0.1.0, <=0.1.3), @huakunshen/kunkun-ip-info (0.0.7) +8 more potentially affected by CVE-2026-95625 via @tauri-apps/plugin-updater (>=2.0.0-beta.3, <=2.10.1)

@tauri-apps/plugin-updater NPM version =2.0.0-beta.3, =0.1.0, =0.0.1-alpha.0, =0.0.2, =0.2.33, =0.1.1, =0.0.2-alpha.0, =0.0.2-alpha.18 - kksh 0.0.23 - kunkun-ext-letterboxd 0.0.3 Source cves: CVE-2026-95625 Source advisory: SNYK:JS-TAURIAPPSPLUGINUPDATER-20081664...

Improper Verification of Cryptographic Signature

Overview @tauri-apps/plugin-updater is a Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the verifysignature function in updater.rs, which does not validate that the version embedded in the signature's trusted comment matches the version...

Cross-site Scripting (XSS)

Overview org.apache.sling:org.apache.sling.xss is a package for providing XSS protection based on the OWASP AntiSamy and OWASP Java Encoder libraries. Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper escaping in the XSS Webconsole plugin. An attacker can...

CVE-2026-90950 Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled...

CVE-2026-87848

The MPCX Lightbox WordPress plugin (versions 1.2.2 through 1.2.5 ) is vulnerable to unauthenticated non-public post content disclosure. The root cause is a lack of authorisation or authentication on one of its AJAX actions , combined with a failure to check the status of the requested post. Conse...

CVE-2026-87848 MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure

The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...

CVE-2026-87071

The Forminator Forms WordPress plugin versions before 1.57.2.1 is vulnerable to Unauthenticated Post Meta Injection . The root cause is the plugin's failure to restrict metadata keys provided during form submissions or to exclude keys reserved by WordPress. Consequently, unauthenticated visitors ...

CVE-2026-86601 WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Brobicho in WordPress Plugin Fluent Support versions = 2.3.2...

EUVD-2026-85181

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution XSS can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no...