CVE-2026-85677: Improper Neutralization of Input During Web Page Generation

The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript...

PT-2026-89812

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-89849

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @...

CVE-2026-17037: Improper Neutralization of Input During Web Page Generation

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-71261

smol-toml: Denial of Service via malformed TOML documents...

CVE-2026-19855

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of t...

CVE-2026-19855 Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of t...

EUVD-2026-74721

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of t...

CVE-2026-19855 Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of t...

CVE-2026-19855

CVE-2026-19855 affects the CleanTalk WordPress plugin (Spam Protection, Honeypot, Anti-Spam) versions prior to 6.87 . The vulnerability allows unauthenticated visitors to inject arbitrary shortcodes via comment text, which are then passed to WordPress's shortcode engine and executed server-side, ...

CVE-2026-75966

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episodecontributor....comment' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2026-88797

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode contributor....comment' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

Interpretation Conflict

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via RFC 5322 comment mis-parsing in lib/addressparser/index.js. An attacker can make mail be delivered to an attacker-controlled domain ...

NPM: Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

NPM: Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain vulnerability discovered by ? in WordPress Npm nodemailer versions = 6.9.16, 9.1.0...

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Summary Nodemailer's email-address parser treats an RFC 5322 comment ... inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace CFWS that terminates the domain. Consequently a recipient address such as [email protected] is parsed and delivere...

GHSA-CC9R-2J5M-2M83 Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Summary Nodemailer's email-address parser treats an RFC 5322 comment ... inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace CFWS that terminates the domain. Consequently a recipient address such as [email protected] is parsed and delivere...

CVE-2026-82537 Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

EUVD-2026-74041

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

PT-2026-88278

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

PT-2026-95045

Summary Nodemailer's email-address parser treats an RFC 5322 comment ... inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace CFWS that terminates the domain. Consequently a recipient address such as [email protected] is parsed and delivere...