CVE-2026-91121

The Discourse open-source discussion platform is vulnerable to trusted-HTML injection in versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 . The root cause is that attacker-controlled upload filenames used in chat message excerpts are rendered as unescaped HTML . An attacker capable of...

CVE-2026-91121 Discourse: Chat upload filenames rendered as raw HTML in excerpts

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

CVE-2026-91121 Discourse: Chat upload filenames rendered as raw HTML in excerpts

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

EUVD-2026-86304

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

CVE-2026-91120 Discourse: Stored HTML injection in video notification emails

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

CVE-2026-91120

The open-source discussion platform Discourse contains a stored HTML injection vulnerability in its video notification email and chat summary generation. Prior to versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 , provider-controlled video titles from lazy video embeds (YouTube, Vimeo, or TikT...

CVE-2026-91120 Discourse: Stored HTML injection in video notification emails

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

CVE-2026-91120 Discourse: Stored HTML injection in video notification emails

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Network component of Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML through a crafted HTML page. Chromium security severity: Medium...

CVE-2026-84151

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

EUVD-2026-85800

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

CVE-2026-84151 The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

CVE-2026-84151

The Post Grid WordPress plugin versions prior to 7.9.5 is vulnerable to HTML injection due to an improper limitation of the WordPress allowed-HTML list. Specifically, the plugin fails to restrict the expansion of this list to its own markup, applying it site-wide. This allows users with the Contr...

WordPress The Post Grid plugin < 7.9.5 - Contributor+ Stored HTML/iframe Injection vulnerability

Contributor+ Stored HTML/iframe Injection vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin The Post Grid versions 7.9.5...

CVE-2026-84151 The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

PT-2026-98203

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description Provider-controlled video titles in lazy video embeds can be reparsed as HTML durin...

PT-2026-98241

Name of the Vulnerable Software and Affected Versions EmbedVideo Extension versions prior to 4.1.0 Description When the $wgEmbedVideoRequireConsent variable is disabled, video URLs are passed into an iframe src attribute without proper sanitization. This allows an attacker to use a malformed URL ...

PT-2026-97711

Name of the Vulnerable Software and Affected Versions The Post Grid versions prior to 7.9.5 Description The plugin fails to limit the expansion of the WordPress allowed-HTML list to its own markup, applying the change site-wide. This allows users with the Contributor role and above to store ifram...

CVE-2026-84151: Improper Neutralization of Input During Web Page Generation

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

PT-2026-98204

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description Attacker-controlled upload filenames used in chat message excerpts are rendered as...