PT-2026-104606

Name of the Vulnerable Software and Affected Versions Simple Shopping Cart WordPress plugin versions prior to 5.2.6 Description Stored Cross-Site Scripting XSS occurs because the plugin fails to escape certain settings field values before they are displayed on the admin settings page. This allows...

CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-105129

LaraDashboard versions prior to 1.4.8 are vulnerable to an incorrect authorization flaw (CWE-863) in the settings API. Authenticated users possessing only the settings.view permission can perform GET requests to /api/settings or /api/settings/{option_name} to access sensitive data. This vulnerabi...

CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability

Settings Change vulnerability discovered by Mor Golan in WordPress Plugin 워드프레스 결제 심플페이 versions = 5.5.17...

CVE-2026-101162

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled...

EUVD-2026-91931

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin...

CVE-2026-101161 WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin...

CVE-2026-101161 WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin...

CVE-2026-101162 WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled...

CVE-2026-101162

The WP Ultimate Review WordPress plugin, in versions prior to 2.4.4 , is vulnerable to Stored Cross-Site Scripting (XSS) . The issue stems from the application failing to properly escape certain review overview settings before they are displayed in posts. If author reviews are enabled, an attacke...

CVE-2026-101161

The WP Ultimate Review WordPress plugin, in versions before 2.4.4 , is vulnerable to a persistent denial of service (DoS) . Unauthenticated users can store crafted review content that triggers a fatal error on every subsequent visit to the reviewed page. This impact occurs specifically when the p...

CVE-2026-101162 WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings

The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled...

[SECURITY] Fedora 45 Update: libwebcam-0.2.5-26.fc45

Libwebcam provides a user-space library for interaction with the uvcvideo kernel driver. One could use this library to manipulate settings for one or many UVC-type webcams found attached on a single computer...

EUVD-2026-91851

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...

CVE-2026-104475

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...

PT-2026-104518

Name of the Vulnerable Software and Affected Versions WP Ultimate Review WordPress plugin versions prior to 2.4.4 Description Stored Cross-Site Scripting XSS occurs when the plugin fails to escape review overview settings before outputting them in posts. This allows users with permissions as low ...

CVE-2026-104475: Improper Neutralization of Input During Web Page Generation

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...

PT-2026-104595

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/option name to retrieve plaintext AI provider API...