61180 matches found
WordPress Kirki plugin 6.2.1-6.2.5 - Unauthenticated Non-Public Post Content Disclosure vulnerability
Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Kirki versions 6.2.1-6.2.5...
CVE-2026-84222
The Kirki WordPress plugin versions before 6.3.0 (specifically identified as 6.2.1-6.2.5) contains a vulnerability that fails to verify if a requester has permission to read a post before rendering and returning its content. This flaw allows unauthenticated users to retrieve content from non-publ...
CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...
CVE-2026-81022
The SupportCandy WordPress plugin affects versions 3.3.6 through 3.5.2 . The vulnerability exists because the plugin fails to validate a submitted per-ticket authorization code before disclosing the actual code to the requester. This flaw allows unauthenticated users to read the contents of any s...
WordPress SupportCandy plugin 3.3.6-3.5.2 - Unauthenticated Ticket Content Disclosure vulnerability
Unauthenticated Ticket Content Disclosure vulnerability discovered by Mitre Osman Hussein in WordPress Plugin SupportCandy versions 3.3.6-3.5.2...
WordPress Content Mask plugin 1.7.1-1.8.5.5 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Andrea Fiocchi in WordPress Plugin Content Mask versions 1.7.1-1.8.5.5...
EUVD-2025-210873
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...
CVE-2025-15690 Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...
CVE-2025-15690 Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...
CVE-2025-15690
The Content Mask WordPress plugin in versions 1.7.1 through 1.8.5.5 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue stems from the plugin's failure to properly sanitise and escape content submitted with a post before it is rendered on generated pages. This allows users with p...
PT-2026-88854
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...
CVE-2025-7062: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of...
SAP NetWeaver Information Disclosure (3750721)
The version of the SAP NetWeaver kernel detected on the remote host is affected by an information disclosure vulnerability as referenced in SAP Security Note 3750721: - SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to...
CVE-2025-15690: Improper Neutralization of Input During Web Page Generation
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...
PT-2026-88873
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...
PT-2026-88878
A stored cross-site scripting XSS vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of...
Security Bulletin: IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)
Summary IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability. Vulnerability Details CVEID:CVE-2026-11710 DESCRIPTION: IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...
EUVD-2026-70251
HTTPX2: Streaming response decompression does not bound peak memory decompression amplification...
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...