CVE-2026-12166

creationtimestamp| type| source ---|---|--- 2026-07-03 10:24:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqdez7upd2n...

CVE-2026-58167

creationtimestamp| type| source ---|---|--- 2026-07-03 10:10:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqcl2uaxn2m...

CVE-2026-8351

creationtimestamp| type| source ---|---|--- 2026-07-03 10:03:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpqc7hkl742w 2026-07-03 20:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpreg665oi2z 2026-07-03 22:35:03+00:00| seen|...

CVE-2026-9545

creationtimestamp| type| source ---|---|--- 2026-07-03 09:56:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpqbriwjim22 2026-07-03 21:33:23+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpriqdj5vb2n 2026-07-08 08:10:35+00:00| seen|...

CVE-2026-12167

creationtimestamp| type| source ---|---|--- 2026-07-03 09:30:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqaegcnxc2q 2026-07-03 10:39:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqe7tchbv2u...

CVE-2026-4804

The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields zakramenuitemcolor, zakramenuitemhovercolor, and zakramenuitemactivecolor with 'showinrest' = tr...

CVE-2026-4967

creationtimestamp| type| source ---|---|--- 2026-07-03 09:13:56+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpq7g3hxl62w 2026-07-03 21:36:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpriv64ea32b 2026-07-05 23:00:19+00:00| seen|...

CVE-2026-54886

creationtimestamp| type| source ---|---|--- 2026-07-03 08:38:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq5g4fr6a2m 2026-07-03 10:36:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqe2coepy2p...

CVE-2026-50282

creationtimestamp| type| source ---|---|--- 2026-07-03 08:24:19+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpq4ndri4a2i 2026-07-03 08:24:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq4neltfq2n 2026-07-03 09:30:24+00:00| seen|...

CVE-2026-4804

The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields zakramenuitemcolor, zakramenuitemhovercolor, and zakramenuitemactivecolor with 'showinrest' = tr...

CVE-2026-4804 Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API

The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields zakramenuitemcolor, zakramenuitemhovercolor, and zakramenuitemactivecolor with 'showinrest' = tr...

CVE-2026-4804

The Zakra WordPress theme (

CVE-2026-11900

The CVE-2026-11900 entry concerns the WordPress plugin Ad Inserter – Ad Manager & AdSense Ads up to version 2.8.16. It is vulnerable to an Insecure Direct Object Reference via the shortcodes’ data attribute. The replace_ai_tags() function processes a {reusable-block-N} pattern by calling get_post...

EUVD-2026-41520

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the adinserter shortcode. This is due to the replaceaitags function processing a reusable-block-N tag pattern that...

CVE-2026-11900

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the adinserter shortcode. This is due to the replaceaitags function processing a reusable-block-N tag pattern that...

CVE-2026-11900 Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the adinserter shortcode. This is due to the replaceaitags function processing a reusable-block-N tag pattern that...

CVE-2026-53358

creationtimestamp| type| source ---|---|--- 2026-07-03 07:15:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppyrs72po2n...

CVE-2026-50748

creationtimestamp| type| source ---|---|--- 2026-07-03 07:06:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppybm6qum2k 2026-07-03 21:35:42+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpriuhp4u22r 2026-07-08 11:01:21+00:00| seen|...

CVE-2026-8921

creationtimestamp| type| source ---|---|--- 2026-07-03 06:42:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppwxkbkw72u 2026-07-03 19:36:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mprc7nvnqc2n...

CVE-2026-9626

The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the postcomment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the postcomment function, which passes the attacker-controlled...