Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the email notification rendering process. An attacker can inject arbitrary HTML content into notification emails sent to recipients by submitting specially crafted input values through a form. Details...

GHSA-VX89-P3J7-8XQC Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Impact The default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients Patches This has been fixed in 5.74.3 and 6.24.2...

CVE-2026-71435

CVE-2026-71435 affects Statamic CMS (Laravel/Git-powered). Prior to versions 5.74.3 and 6.24.2, the default automagic form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into notification emails sent to configured reci...

EUVD-2026-54239

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, the default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the...

CVE-2026-71435 Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, the default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the...

CVE-2026-71435 Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, the default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the...

CVE-2026-15147

The vulnerability CVE-2026-15147 affects the Five Star Restaurant Reservations WordPress plugin prior to version 2.7.23. The issue is an unauthenticated payment-notification bypass caused by failing to verify the payment recipient, amount, and status, and not binding the notification to the inten...

CVE-2026-12901 GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification

The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...

CVE-2026-12901 GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification

The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...

CVE-2026-12901

The CVE-2026-12901 entry concerns the GetPaid WordPress plugin (versions prior to 2.8.55). The vulnerability arises because Worldpay payment notifications are not authenticated, enabling unauthenticated attackers to forge a notification that marks a pending invoice as paid without real payment. I...

WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Aydan Arabadzha in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

CVE-2026-12901: Insufficient Verification of Data Authenticity

The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...

Malicious code in @servicetitan/notifications (npm)

npm/@servicetitan/notifications is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11909 Malicious code in @servicetitan/notifications (npm)

npm/@servicetitan/notifications is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CVE-2026-16291

The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers...

CVE-2026-15151 Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...

CVE-2026-15151

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...

EUVD-2026-51932

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...

CVE-2026-2411

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions e.g. BTGATTPERMREADENCRYPT /...

CVE-2026-14309

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their...