CVE-2026-73331

CVE-2026-73331 : CamaleonCMS 2.9.1 contains an authenticated SQL injection via the post slug field. Authenticated users with post creation/edit privileges can submit a crafted slug containing SQL syntax that is evaluated by an inadequately parameterized query. Attack techniques described include ...

CVE-2026-15425

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-48765

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15425 Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15425

The CVE concerns the Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress (Yoast SEO) vulnerable to Stored Cross-Site Scripting via the Post Slug (post_name) feature. Affected versions: all up to and including 28.0. Root cause: insufficient input sanitization and ...

CVE-2026-15425 Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15425

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-64475

Name of the Vulnerable Software and Affected Versions Yoast SEO versions prior to 28.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or higher can inject arbitrary web scripts into pages...

PT-2026-34854

The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admin init hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php...

CVE-2022-20617

creationtimestamp| type| source ---|---|--- 2025-08-21 21:02:33+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lwwto2ud5r2t...

DEBIAN-CVE-2023-5692

WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirectguess404permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publiclyqueryable' post status has been set to 'false'...

PT-2024-14827 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: WordPress Core versions up to, and including, 6.4.3 Description: The issue allows unauthenticated attackers to expose the slug of a custom post whose publicly queryable post status has been set to 'false' via the redirect guess 404 permalink...

CVE-2023-2495 Greeklish-permalink < 3.5 - Unauthenticated Post Slug Update

The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtransajaxold AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF...

Greeklish-permalink <= 3.3 - Unauthenticated Post Slug Update

The plugin does not implement correct authorization or nonce checks in the cyrtransajaxold AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF. 1. Create a post with the name "Νέα ανάρτηση". 2...