CVE-2026-1854

CVE-2026-1854 concerns the WordPress Post Flagger plugin. A stored XSS vulnerability exists via the plugin’s 'flag' shortcode attribute in all versions up to and including 1.1 due to insufficient input sanitization and output escaping. The issue can be chained by an authenticated attacker with co...

CVE-2026-1854 Post Flagger <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute

The Post Flagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flag' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2026-1854 Post Flagger <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute

The Post Flagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flag' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2026-3570

The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0. This is due to missing authentication and capability checks on the configuration reset functionality in the global scope of smarter-analytics.php. This makes it possible for...

CVE-2026-2941

creationtimestamp| type| source ---|---|--- 2026-03-21 03:17:13+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-2941 2026-03-21 06:44:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhkgl6tcpc2k 2026-03-21 20:01:11+00:00| seen|...

CVE-2026-32049

creationtimestamp| type| source ---|---|--- 2026-03-21 02:41:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhjyy2flk42y 2026-03-21 22:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhlzrziedd2c 2026-03-22 03:00:05+00:00| seen|...

CVE-2026-33179

creationtimestamp| type| source ---|---|--- 2026-03-21 01:54:31+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mhjweler5j2w 2026-03-21 04:45:06+00:00| seen| https://bsky.app/profile/crustytldr.bsky.social/post/3mhk7vmgu6d2e 2026-03-24 12:18:06+00:00| seen|...

EUVD-2026-13838

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aopostpreload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the aometaboxsave function and missing output escaping when the value is rendered in...

EUVD-2026-13816

A security issue was discovered in the Feast Feature Server's /read-document endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to...

CVE-2026-33210

creationtimestamp| type| source ---|---|--- 2026-03-21 00:23:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhjrcbb3ys2n 2026-03-31 05:19:43+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3midgiqlbmy2s 2026-04-16 12:00:59+00:00| seen|...

CVE-2026-3350

The Image Alt Text Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.8.2. This is due to insufficient input sanitization and output escaping when dynamically generating image alt and title attributes using a DOM...

CVE-2026-33422

creationtimestamp| type| source ---|---|--- 2026-03-21 00:04:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhjq75xxiy2e...

PT-2026-26865

The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.23. This is due to the plugin registering the 'build-app-online-update-vendor-product' AJAX action via wp ajax nopriv without proper authentication checks, capability...

WordPress plugin Post Affiliate Pro 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Discourse 安全漏洞

Discourse is Discourse open source set of open source community discussion platform. The platform includes features such as community , e-mail and chat rooms . Discourse suffers from a security vulnerability due to an overly broad authorization check on the deleted post index endpoint, which can ...

PT-2026-26827

The Company Posts for LinkedIn plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.0. This is due to a missing capability check on the linkedin company post reset handler function hooked to admin post reset linkedin company post. This makes it...

PT-2026-26811

The login register plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.2.0. This is due to missing nonce validation on the settings page and insufficient input sanitization and output escaping on the 'login regist...

Fedora 42 : cpp-httplib (2026-6ed9c65eaf)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6ed9c65eaf advisory. Update to 0.37.1 rbhz2445943 - Fixes Denial of Service via malformed Content-Length header CVE-2026-31870 - Reenables 32-bit build Update to 0.37.0...

WordPress plugin Sherk Custom Post Type Displays 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-26843

The Post Snippits plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page handlers for saving, adding, and deleting snippets. This makes it possible for unauthenticated attackers to...