WordPress Meta Box plugin < 5.13.1 - Contributor+ Arbitrary Attachment Deletion vulnerability

Contributor+ Arbitrary Attachment Deletion vulnerability discovered by Duy in WordPress Plugin Meta Box – WordPress Custom Fields Framework versions 5.13.1...

WordPress Five Star Restaurant Reservations plugin < 2.7.23 - Booking Manager+ Missing Authorization vulnerability

Booking Manager+ Missing Authorization vulnerability discovered by Minar in WordPress Plugin Five Star Restaurant Reservations versions 2.7.23...

WordPress FluentBoards plugin < 1.95.3 - Subscriber+ Cross-Board Task Disclosure vulnerability

Subscriber+ Cross-Board Task Disclosure vulnerability discovered by Diogo Pinto in WordPress Plugin FluentBoards versions 1.95.3...

WordPress Brizy plugin < 2.8.18 - Contributor+ Sensitive Information Disclosure vulnerability

Contributor+ Sensitive Information Disclosure vulnerability discovered by Mustafa Ahmed in WordPress Plugin Brizy versions 2.8.18...

WordPress Fluent Support plugin < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment vulnerability

Agent+ Arbitrary Ticket Customer Reassignment vulnerability discovered by Mustafa Ahmed in WordPress Plugin Fluent Support versions 2.3.1...

CVE-2026-18452

DMS+ Non-Mobile developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices...

WordPress BuddyPress plugin < 14.5.0 - Subscriber+ Private Messages Disclosure vulnerability

Subscriber+ Private Messages Disclosure vulnerability discovered by Mustafa Ahmed in WordPress Plugin BuddyPress versions 14.5.0...

WordPress JS Help Desk plugin < 3.1.4 - Contributor+ User Email Disclosure vulnerability

Contributor+ User Email Disclosure vulnerability discovered by Vaibhav Narkhede in WordPress Plugin JS Help Desk versions 3.1.4...

WordPress JS Help Desk plugin < 3.1.4 - Subscriber+ Ticket Reply Modification vulnerability

Subscriber+ Ticket Reply Modification vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin JS Help Desk versions 3.1.4...

CVE-2026-14922

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize double-encoding flaw in the photo-comment pipeline. On write, wppadocomment sanitizes the comment with wppafilterhtml wpkses followed by wpstripalltags...

EUVD-2026-51419

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize double-encoding flaw in the photo-comment pipeline. On write, wppadocomment sanitizes the comment with wppafilterhtml wpkses followed by wpstripalltags...

WordPress Paid Membership Subscriptions plugin < 3.0.7 - Subscriber+ Payment Data Disclosure vulnerability

Subscriber+ Payment Data Disclosure vulnerability discovered by WEI HSIANG WANG in WordPress Plugin Paid Member Subscriptions versions 3.0.7...

CVE-2026-18452 Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials

DMS+ Non-Mobile developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices...

CVE-2026-18452

CVE-2026-18452 affects DMS+ (Non-Mobile) by Rich Source and is due to use of hard-coded credentials (a fixed API key). Unauthenticated remote attackers can exploit this to gain control over all installed DMS+ devices. The provided metrics indicate a critical impact (CVSS v4.0 10.0; CVSS v3.1 10.0...

EUVD-2026-51406

DMS+ Non-Mobile developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices...

ManageEngine ADAudit Plus < Build 8606 Unauthenticated RCE

The ManageEngine ADAudit Plus running on the remote host is prior to build 8606. It is, therefore, affected by an unauthenticated remote code execution vulnerability: - Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by unauthenticated remote code execution due to the...

CVE-2026-14922: Improper Neutralization of Input During Web Page Generation

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize double-encoding flaw in the photo-comment pipeline. On write, wppadocomment sanitizes the comment with wppafilterhtml wpkses followed by wpstripalltags...

PT-2026-66719

DMS+ Non-Mobile developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices...

Joern 4.0.593

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CVE-2026-12562

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework TCF service that does not require any...