EUVD-2026-31067

The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses...

CVE-2026-5776 Email Encoder < 2.4.7 - Unauthenticated Stored XSS

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks...

CVE-2026-5776

The Email Encoder WordPress plugin versions prior to 2.4.7 is vulnerable to an unauthenticated Stored XSS attack. The root cause is a failure to properly escape email addresses retrieved via user input. An attacker can exploit this to execute malicious scripts in the context of other users. No sp...

EUVD-2026-31068

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks...

CVE-2026-5776

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks...

CVE-2026-5776 Email Encoder < 2.4.7 - Unauthenticated Stored XSS

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks...

PT-2026-42143

Name of the Vulnerable Software and Affected Versions Meona Client Launcher Component versions prior to 19.06.2020 15:11:49 Meona Server Component versions prior to 2025.04 5+323020 Description Insufficient Verification of Data Authenticity in the Meona Client Launcher and Meona Server components...

WordPress plugin Email Encoder has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There wa...

PT-2026-42189

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description The OIDC authentication plugin allows automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account lacks a stored sub value. In scenari...

📄 Barracuda ESG Spreadsheet::ParseExcel Arbitrary Code Execution

This Metasploit module exploits CVE-2023-7102, an arbitrary code execution vulnerability in Barracuda Email Security Gateway ESG appliances. The vulnerability exists in how the Amavis scanner processes Excel attachments using the Perl Spreadsheet::ParseExcel library. The librarys Utility.pm...

PT-2026-42058

The Oliver POS – A WooCommerce Point of Sale POS plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/ REST API namespace through the oliver pos rest authentication...

WordPress plugin Decent Comments has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

PT-2026-42113

Name of the Vulnerable Software and Affected Versions Decent Comments versions prior to 3.0.2 Description The Decent Comments WordPress plugin fails to restrict access to comment author and post author email addresses through its REST API endpoint. This allows unauthenticated attackers to enumera...

PT-2026-42111

Name of the Vulnerable Software and Affected Versions Email Encoder versions prior to 2.4.7 Description The Email Encoder WordPress plugin fails to escape email addresses retrieved via user input. This allows unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where...

CVE-2026-9084: Improper Authentication

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid...

CVE-2026-25602: Insufficient Verification of Data Authenticity

Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA MEONA Client and MEONA Server. The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the report to the transmitted address instead of the address...

CVE-2026-7385: Undefined Security Weakness

The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses...

CVE-2026-5776: Undefined Security Weakness

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks...

MISP Authorization Issue Vulnerability

MISP is a set of open-source software solutions developed by MISP. This product is used for collecting, storing, distributing, and sharing network security metrics. It also includes features for analyzing threats to network security and malware analysis. MISP has an authorization vulnerability;...

CVE-2026-3985: Improper Neutralization of Special Elements used in an SQL Command

The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkoutuuid' parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...