CVE-2026-78068

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.3.35 . The root cause is insufficient input sanitization and output escaping within the Table Cell Content. This allows authenticated attackers with...

CVE-2026-96743

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-96743 Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-96036

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-96743

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.4.1-RC2 . The root cause is insufficient input sanitization and output escaping of Table Field Values. This allows authenticated attackers with subscrib...

PT-2026-109894

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can create department permission bindings due to missing authorization. By sending requests to the endpoint "POST /sys/sysDepartPermission/add", an attacker can...

CVE-2026-108633: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button...

CVE-2026-78068: Improper Neutralization of Input During Web Page Generation

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell Content in all versions up to, and including, 1.3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-108617: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes...

CVE-2026-66480: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0...

CVE-2026-96743: Improper Neutralization of Input During Web Page Generation

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-109878

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw allows authenticated users with low privileges to create message templates. By calling the POST '/sys/message/sysMessageTemplate/add' endpoint, an attacker can insert arbitrar...

WordPress Table Field Add-on for ACF and SCF plugin <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Omar Elshopky 3l5h0pky in WordPress Plugin Table Field Add-on for ACF and SCF versions = 1.3.35...

WordPress Table Field Add-on for ACF and SCF plugin < 1.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via Table Field Value vulnerability discovered by Kuba in WordPress Plugin Table Field Add-on for ACF and SCF versions 1.4.1...

CVE-2026-108101 HortusFox through 6.3 Unrestricted File Upload via Plant Attachments

HortusFox hortusfox-web through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored...

EUVD-2026-95627

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0...

CVE-2026-107886

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, addclass frees pclass-printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer;...

CVE-2026-107886

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, addclass frees pclass-printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer;...

CVE-2026-94664: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0...

PT-2026-108833

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0...