OPENSUSE-SU-2026:22124-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 155.0.8059.84 boo1285733: CVE-2026-110922: Use after free in Prerender CVE-2026-110913: Memory corruption in DOM CVE-2026-110919: Use after free in V8 CVE-2026-110918: Memory corruption in Core CVE-2026-110917:...

CVE-2026-110662

The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109370

The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content postcontent containing block JSON documentSource.doc' parameter in all versions up to, and including, 2.4.0 due to insufficient input...

CVE-2026-109370 Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute

The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content postcontent containing block JSON documentSource.doc' parameter in all versions up to, and including, 2.4.0 due to insufficient input...

CVE-2026-109370

The Document Embedder WordPress plugin (versions up to and including 2.4.0 ) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) . The issue stems from insufficient input sanitization and output escaping within the content parameter (specifically post_content containing block JSON docume...

EUVD-2026-111607

The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content postcontent containing block JSON documentSource.doc' parameter in all versions up to, and including, 2.4.0 due to insufficient input...

CVE-2026-110662

The MxChat WordPress plugin (all versions up to and including 3.2.25 ) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'feedback' parameter. An unauthenticated attacker can inject arbitrary web scripts by ...

EUVD-2026-111736

The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-110662 MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating

The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109999

The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient...

CVE-2026-109999 AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter

The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient...

EUVD-2026-111561

The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient...

CVE-2026-109999

The AI Marketing Expert WordPress plugin is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 1.2.8 . The root cause is insufficient input sanitization and output escaping of the 'name' parameter . An unauthenticated attacker can inject arbitrary web sc...

CVE-2026-109999 AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter

The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient...

CVE-2026-118012

Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...

CVE-2026-118015

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...

CVE-2026-118019

Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...

CVE-2026-118016

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...

CVE-2026-118008

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159...

CVE-2026-117998

Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...