5929 matches found
CVE-2026-82627
The Uncanny Automator plugin for WordPress (versions up to and including 7.6.1.1 ) is vulnerable to PHP Object Injection due to the deserialization of untrusted input. This flaw allows authenticated attackers with Subscriber-level access or higher to inject a PHP Object. The attack is feasible wh...
CLEANSTART-2026-QB50349 Actions which insert URLs into the content attribute of HTML meta tags are not escaped
CVE-2026-27142 affects multiple packages. Actions which insert URLs into the content attribute of HTML meta tags are not escaped. See references for individual vulnerability details...
CLEANSTART-2026-FK00511 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute
CVE-2026-39823 affects multiple packages. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. See references for individual vulnerability details...
Mechanize sends credential headers to another origin after a meta refresh
Summary mechanize applied no trust boundary to a meta refresh, so credentials set through Mechanizerequestheaders= followed a refresh that pointed at another origin. Details Mechanize::HTTP::Agentresponsefollowmetarefresh fetched the refresh target with no notion of a crossed origin, so...
PT-2026-108213
Name of the Vulnerable Software and Affected Versions Mechanize versions prior to 2.14.1 Description When Mechanizefollow meta refresh is enabled, the library fails to apply an origin trust boundary in the Mechanize::HTTP::Agentresponse follow meta refresh function. This allows headers configured...
PT-2026-107808
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload files function. This is due to missing file type validation in the upload files function, which reads and applies an...
CVE-2026-107399: Exposure of Sensitive Information to an Unauthorized Actor
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...
EUVD-2026-93517
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead...
NPM: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
NPM: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead vulnerability discovered by ? in WordPress Npm quasar versions 2.22.0...
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
Vulnerability Details File: ui/src/utils/meta/Meta.js — actually ui/src/plugins/meta/Meta.js lines 149-176: getAttr and getHead Sink: injectServerMeta same file → ctx.headTags += getHeaddata, interpolated verbatim into the raw HTTP response by the production SSR template...
CVE-2026-102173 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in ExceptionalElements::imageelement, which concatenates a...
CVE-2026-106102
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead serializer in ui/src/plugins/meta/Meta.js used getAttr to interpolate values supplied through useMeta into title, meta, link, and script markup without HTML text or...
CVE-2026-106102 Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead serializer in ui/src/plugins/meta/Meta.js used getAttr to interpolate values supplied through useMeta into title, meta, link, and script markup without HTML text or...
CVE-2026-106102
The Quasar Framework contains a vulnerability in the SSR-only getHead() serializer located in ui/src/plugins/meta/Meta.js. Prior to version 2.22.0 , the getAttr() function interpolated values from useMeta() into title , meta , link , and script markup without proper HTML text or quoted-attribute ...
CVE-2026-106102 Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead serializer in ui/src/plugins/meta/Meta.js used getAttr to interpolate values supplied through useMeta into title, meta, link, and script markup without HTML text or...
CVE-2026-39761
Unauthenticated Privilege Escalation in Meta Box AIO = 3.7.1 versions...
CVE-2026-39761 WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Meta Box AIO = 3.7.1 versions...
CVE-2026-39761 WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Meta Box AIO = 3.7.1 versions...