CVE-2026-66640: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Login With Ajax = 4.5.1 versions...

PT-2026-77287

Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in AppHttpKernel.php that is never instantiated under the Laravel 11+ skeleton,...

GHSA-92HR-GMR6-H8CP Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

Fix: PR 7906 ether/etherpad. A set of medium/low hardening fixes: - Weak RNG for tokens CWE-330: author/session/readonly IDs were generated with Math.random client and server. Now use crypto.getRandomValues. - Login timing / no failure delay CWE-208/CWE-307: the OIDC interaction login used a...

PT-2026-76793

Name of the Vulnerable Software and Affected Versions Tneda W20E version 16.01.0.62782 Description A remote attacker can execute arbitrary code through the url need login function. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

PT-2026-73286

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted...

CVE-2026-2283

The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blogid' parameter in all versions up to, and including, 2.1.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-19714

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Log...

CVE-2026-19714 Simple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience Validation

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Log...

CVE-2026-19714

The Simple JWT Login WordPress plugin, in versions prior to 3.6.8 , is vulnerable to an unauthenticated account takeover due to a lack of audience validation for Google identity tokens. An attacker can exploit this by using a valid Google identity token to authenticate as any user associated with...

EUVD-2026-59916

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Log...

CVE-2026-19714 Simple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience Validation

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Log...

CVE-2026-19714

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Log...

CVE-2026-2283

The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blogid' parameter in all versions up to, and including, 2.1.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

EUVD-2026-59896

The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blogid' parameter in all versions up to, and including, 2.1.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-2283 User Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter

The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blogid' parameter in all versions up to, and including, 2.1.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-2283 User Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter

The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blogid' parameter in all versions up to, and including, 2.1.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-2283

The CVE concerns the WordPress plugin “User Login History.” Affected: WordPress User Login History plugin (all versions up to and including 2.1.7). Issue: SQL Injection via the blog_id parameter caused by insufficient escaping and inadequate query preparation. Context: Exploitation is limited to ...

CVE-2026-2487

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

EUVD-2026-59847

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-2487 Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...