PT-2026-104631

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 3.4.15 ZITADEL versions 4.0.0 through 4.17.2 Description An issue exists where links are created between user accounts and external identity providers without verifying a primary factor or the caller's permission...

CVE-2026-105124: Improper Neutralization of Input During Web Page Generation

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

CVE-2026-105207: Missing Authentication for Critical Function

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...

PT-2026-104611

Name of the Vulnerable Software and Affected Versions User Private Files WordPress plugin versions prior to 2.2.0 Description On multisite installations, the plugin fails to protect stored private files because the rewrite rule used to route file requests through the access check is not reached...

PT-2026-104634

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210: Improper Authentication

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

PT-2026-104604

Name of the Vulnerable Software and Affected Versions Omega Solution CoinEx Crypto 2025 affected versions not specified Description A weakness in the Ticket Attachment Upload component allows for remote cross-site scripting XSS, a technique where malicious scripts are injected into trusted...

CVE-2026-105124 W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Pedro Delgado in WordPress Plugin WP User Manager versions = 2.9.20...

CVE-2026-96451 WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...

Exploit for CVE-2026-19660

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

Malicious code in @nagular/router (npm)

@nagular/[email protected] impersonates router it copies the code and metadata of the pillarjs router package and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

CVE-2026-80518 WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...

EUVD-2026-91919

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-97344 Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-97344 Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-92551 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppressbillingaddress Filename Parameter in all versions up to, and including, 4.17.4 due to insufficie...

PT-2026-104586

Name of the Vulnerable Software and Affected Versions Ultimate Member versions prior to 2.13.2 Description An authorization bypass exists due to a user-controlled key, which allows for privilege escalation. Recommendations Update to version 2.13.2 or later...

PT-2026-104511

Name of the Vulnerable Software and Affected Versions Strong Testimonials versions prior to 3.3.12 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a...

CVE-2026-96270: Improper Neutralization of Input During Web Page Generation

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...