GHSA-QMCQ-XW74-W667 uniget CLI has an EDITOR Command Injection

Summary The uniget CLI has a command injection vulnerability in hooks.go line 199 where strings.Spliteditor, " " naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR="/path/to/wrapper && id && echo" which gets split into separate arguments,...

WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter vulnerability

Authenticated Editor+ SQL Injection via 'key' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...

BIT-DISCOURSE-2026-72730 Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

EUVD-2026-60355

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50771

A stored/reflected XSS vulnerability exists in Squirro Cognitive Search versions below 3.14.2, exploitable through the Email Notification, Create Evaluation Sets, and HTML Editor functions. No authentication is required, though user interaction is needed. CVSS 6.1 (MEDIUM) reflects low confidenti...

PT-2026-76877

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 10.11.0 through 10.11.21 Mattermost versions 11.8.0 through 11.8.3 Description The Boards plugin fails to enforce the PermissionManageBoardRoles authorization on the channelId field...

CVE-2026-17604 Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

CVE-2026-17604

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

CVE-2026-15002 Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter

The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave method being wired to the WordPress 'init' hook by...

CVE-2026-12477

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

EUVD-2026-59856

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2026-73087

The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bm woocommerce css editor content' POST parameter. This is due to the Css Editor::handle save method being wired to the WordPress 'init' hook ...

CVE-2026-16146

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation...

CVE-2026-16094

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-16146

CVE-2026-16146 affects the WordPress plugin “Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms.” All versions up to 5.1 are affected by a generic SQL Injection in Pattern JSON Keys/Values caused by insufficient escaping of user-supplied input and inadequate query preparation. Th...

CVE-2026-16094

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-16094 Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

PT-2026-72154

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...