EUVD-2026-68785

Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...

WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by JunHee CHO in WordPress Plugin OwnerRez API versions = 1.2.6...

CVE-2026-61965 WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in GeekyBot = 1.2.6 versions...

WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin GeekyBot versions = 1.2.6...

CLSA-2026-1784596354 TuxCare security update for follow-redirects (5 CVEs)

TuxCare rebuilt follow-redirects to address 5 CVEs. Fixed in 1.2.6-tuxcare.1...

WordPress Database for CF7 plugin <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Chawabhon Netisingha JNX03 in WordPress Plugin Database for CF7 versions = 1.2.6...

CVE-2026-13425

The CVE covers the WordPress plugin Database for CF7, affected up to version 1.2.6, vulnerable to unauthenticated Stored XSS via array-form field values. Root cause: insufficient input sanitization and output escaping; data stored with serialize() into wp_cf7db bypasses WordPress save-time filter...

CVE-2026-13425 Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-13335

The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpmpoint' Post Meta in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-39929

The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpmpoint' Post Meta in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-53041

Name of the Vulnerable Software and Affected Versions CodePeople Post Map for Google Maps versions prior to 1.2.7 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is...

Security Bulletin: Multiple Vulnerabilities in Hyper-Converged Database 1.2

Summary Multiple vulnerabilities were addressed in Hyper-Converged Database version 1.2.6 Vulnerability Details CVEID:CVE-2026-5588 DESCRIPTION: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all pkix modules, Legion of the...

EUVD-2026-36361

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in iova.Mihai SliceWP allows Stored XSS. This issue affects SliceWP: from n/a through 1.2.6...

CVE-2026-42653 WordPress SliceWP plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in iova.Mihai SliceWP allows Stored XSS. This issue affects SliceWP: from n/a through 1.2.6...

CVE-2026-42653

The CVE-2026-42653 vulnerability affects the WordPress SliceWP plugin (

CVE-2026-5028

The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the pp-get-articles AJAX action in all versions up to, and including, 1.2.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficie...

JoomSky Joomla com_jsjobs 路径遍历漏洞

JoomSky Joomla comjsjobs is a recruitment and job management component provided by JoomSky Inc. Version 1.2.6 of JoomSky Joomla comjsjobs contains a path traversal vulnerability. This vulnerability arises from improper handling of custom user field parameters, which may allow authenticated...

CVE-2026-9609 QianFox FoxCMS Admin.php edit password recovery

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9608

CVE-2026-9608 affects QianFox FoxCMS (up to version 1.2.6) in the Administrator Backend, specifically the /Tag/edit function where a manipulated request can trigger cross-site scripting. The vulnerability arises from an unspecified element/function within that file, allowing remote exploitation. ...

FoxCMS 授权问题漏洞

FoxCMS is a content management system provided by FoxCMS Company in China, available for free commercial use and open source. Versions of FoxCMS 1.2.6 and earlier have a licensing issue vulnerability, which stems from a weak password recovery vulnerability in the Edit function of the Admin.php fi...