CVE-2026-116763

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-111418

A server-side request forgery SSRF vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources...

CVE-2026-111417 Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users...

CVE-2026-111417 Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users...

EUVD-2026-112697

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users...

CVE-2026-111417

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service . The root cause is the use of a shared token for submitted conversion documents, which may allow unauthorized users to access documents submitted by others. While the vulnerability is conf...

EUVD-2026-112696

A server-side request forgery SSRF vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources...

CVE-2026-111418 SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service

A server-side request forgery SSRF vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources...

CVE-2026-111418 SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service

A server-side request forgery SSRF vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources...

CVE-2026-111418

A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service . The root cause is that the service supports ZIP-formatted input , which can be used to bypass restrictions on requests to internal IP addresses. This could potentially allow ...

CVE-2026-116763 LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-116763 LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-116763

The LiteSpeed Cache plugin for WordPress (versions up to and including 7.9.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'comment' parameter . The root cause is insufficient input sanitization and output escaping. This vulnerability is specifically exploitable when the HTML Minif...

EUVD-2026-112690

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2026-112685

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-107629

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in versions up to and including 13.2.1 . The root cause is insufficient input sanitization and output escaping of the comment parameter. An unauthenticated attacker...

CVE-2026-107629 Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-107629 Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-114729

A flaw was found in Roundcube Webmail. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing Scalable Vector Graphics SVG animations with an unvalidated animation attribute. The application's HTML sanitizer fails to inspect this attribute for remote...

CVE-2026-114728

A flaw was found in Roundcube Webmail. The HTML message sanitizer fails to properly normalize all valid CSS escape sequences when inspecting external resource attributes. A remote attacker can exploit this flaw by sending a crafted email that bypasses remote content blocking, causing external...