PT-2026-103892

Subscriber Broken Access Control in Social Boost = 3.6.2 versions...

CVE-2026-87915: Improper Neutralization of Input During Web Page Generation

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...

CVE-2026-15797: Improper Neutralization of Input During Web Page Generation

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-65162

Unauthenticated SQL Injection in Boost = 2.0.4 versions...

EUVD-2026-65163

Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...

CVE-2026-32555

Unauthenticated SQL Injection in Boost = 2.0.4 versions...

CVE-2026-32556

Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...

CVE-2026-32556

CVE-2026-32556 affects the WordPress Boost plugin versions 2.0.4 and earlier , introducing an unauthenticated Cross-Site Scripting (XSS) vulnerability. A remote attacker can inject malicious script content that executes in the context of a victim's browser, requiring user interaction but no prior...

CVE-2026-32556 WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...

CVE-2026-32556 WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...

CVE-2026-32555 WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability

Unauthenticated SQL Injection in Boost = 2.0.4 versions...

CVE-2026-32555

CVE-2026-32555 is an unauthenticated SQL injection vulnerability in the WordPress Boost plugin , affecting versions 2.0.4 and earlier . The flaw allows a remote, unauthenticated attacker to exploit the injection over the network with low complexity and no user interaction , resulting in high conf...

CVE-2026-32555 WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability

Unauthenticated SQL Injection in Boost = 2.0.4 versions...

WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Boost versions = 2.0.4...

WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by luc in WordPress Plugin Boost versions = 2.0.4...

PT-2026-81047

Name of the Vulnerable Software and Affected Versions Boost versions 2.0.4 and earlier Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database...

PT-2026-81048

Name of the Vulnerable Software and Affected Versions Boost versions prior to 2.0.5 Description An unauthenticated Cross-Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the context of a user's session without requiring prior authentication. Recommendation...

CVE-2026-32555: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Boost = 2.0.4 versions...

CVE-2026-32556: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...

MAL-2026-13413 Malicious code in @astralcore/aura-wb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd4a1b22725e981c18c44de0f81915a5048b58bdcacfe6935c9dfcb3dceb641c The package is a WhatsApp Baileys bot whose default configuration in config/index.js points MONGODBURI at a hardcoded shared Atlas cluster...