CVE-2026-85678 AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...

CVE-2026-85678

The AI Builder WordPress plugin (versions 2.4.1-2.7.7 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitise custom JavaScript saved against a post before it is echoed inside a script tag on the front end. This allows users with contributor level ac...

CVE-2026-85678 AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...

CVE-2026-64836

creationtimestamp| type| source ---|---|--- 2026-09-11 05:20:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv7syggejg25...

CVE-2026-56711

creationtimestamp| type| source ---|---|--- 2026-09-11 05:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv7syds2f72p 2026-09-11 08:54:11+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mva6x6vu5v2q 2026-09-11 16:37:28+00:00| seen|...

CVE-2026-87812

creationtimestamp| type| source ---|---|--- 2026-09-11 05:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv7sgiqzx525...

CVE-2026-75704

creationtimestamp| type| source ---|---|--- 2026-09-11 05:09:36+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mv7sfmkbun2f...

CVE-2026-89151

creationtimestamp| type| source ---|---|--- 2026-09-11 04:13:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/i3xvqtlbegpim...

CVE-2026-57166

creationtimestamp| type| source ---|---|--- 2026-09-11 03:30:36+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mv7mulx3f32z 2026-09-11 03:30:41+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117250289500372314...

PT-2026-89848

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...

CVE-2026-11446: Missing Authorization

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

CVE-2026-89265: Missing Authorization

MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a catego...

CVE-2026-89264: Authorization Bypass Through User-Controlled Key

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including...

CVE-2026-50018: Uncontrolled Resource Consumption

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns...

CVE-2026-89251: Insufficient Verification of Data Authenticity

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/ADServer/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests...

CVE-2026-18994

creationtimestamp| type| source ---|---|--- 2026-09-10 23:05:26+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mv762hoxt62b...

CVE-2026-11813

creationtimestamp| type| source ---|---|--- 2026-09-10 23:04:43+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mv75z5ono52o...

CVE-2026-84889

creationtimestamp| type| source ---|---|--- 2026-09-10 23:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv75ryhdtm2b 2026-09-15 07:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvk4j3crjs2y...

CVE-2026-75777

creationtimestamp| type| source ---|---|--- 2026-09-10 22:52:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6px52ukanfy7v...

CVE-2026-82079

creationtimestamp| type| source ---|---|--- 2026-09-10 21:21:17+00:00| seen| https://bsky.app/profile/sundhaug.com/post/3mv6ya5sqyk2g 2026-09-14 13:11:44+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mvi6qiv44c2y 2026-09-16 13:29:14+00:00| seen|...