PT-2026-71508

Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...

PT-2026-71576

Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...

PT-2026-71527

Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...

PT-2026-71517

Unauthenticated Cross Site Scripting XSS in Do Lasso = 358 versions...

PT-2026-71534

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...

PT-2026-71563

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

PT-2026-71545

Unauthenticated Cross Site Scripting XSS in Agrion = 1.0.0 versions...

PT-2026-71502

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

PT-2026-71600

Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

PT-2026-71509

Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.25 versions...

PT-2026-71592

Unauthenticated Cross Site Scripting XSS in SureDash = 1.10.1 versions...

PT-2026-71604

Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...

PT-2026-71684

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

PT-2026-71574

Unauthenticated Cross Site Scripting XSS in Local Delivery Drivers for WooCommerce = 3.0.0 versions...

PT-2026-71521

Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...

PT-2026-71524

Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...

DEBIAN-CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73427

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...

UBUNTU-CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

[SECURITY] [DLA 4736-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4736-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 12, 2026 https://wiki.debian.org/LTS -...