EUVD-2026-66773

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

PT-2026-82384

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...

PT-2026-82418

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

CVE-2026-78138: Exposure of Sensitive Information to an Unauthorized Actor

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

VulnCheck KEV: CVE-2026-76581

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

PT-2026-82429

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

CVE-2026-81202

A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed fr...

Malicious code in octopus-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6968c2a12f60b671ee163f42c9da14ed51d9b0b29486b4a7d1bf5014b4c637f2 The package declares a preinstall lifecycle script node index.js that runs automatically on npm install. index.js collects the installer's hostname, ...

MAL-2026-14537 Malicious code in octopus-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6968c2a12f60b671ee163f42c9da14ed51d9b0b29486b4a7d1bf5014b4c637f2 The package declares a preinstall lifecycle script node index.js that runs automatically on npm install. index.js collects the installer's hostname, ...

Exploit for CVE-2026-75604

CVE-2026-75604 RCE PoC Python proof of concept for CVE-2026-...

WordPress CM Map Locations plugin <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action vulnerability

Authenticated Subscriber+ Arbitrary File Upload via cmlocrouteimageupload AJAX Action vulnerability discovered by Spy0x7 in WordPress Plugin CM Map Locations versions = 2.1.8...

EUVD-2026-66285

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

CVE-2026-19632

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

EUVD-2026-66230

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

CVE-2026-19632 TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

CVE-2026-19632

The TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin (versions ≤ 3.3.1 ) is vulnerable to Sensitive Information Exposure via the trp_get_translations_regular AJAX action. This flaw allows unauthenticated attackers to extract raw administrator password-reset URLs ...

CVE-2026-5092: Improper Neutralization of Input During Web Page Generation

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versions up to, and including, 12.8.9. This is due to insufficient sanitization of API responses before output via innerHTML. This makes it...

CVE-2026-63360: Improper Neutralization of Input During Web Page Generation

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

PT-2026-82327

Name of the Vulnerable Software and Affected Versions itsourcecode Payroll System version 1.0 Description A flaw in the CRUD Operation Handler component allows remote attackers to bypass authentication. The issue exists within the create/read/update/delete function of the ajax.php file. By...

CVE-2026-81203: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...