Shield Security Plugin < 20.0.6 - Cross-Site Scripting

The Shield Security WordPress plugin before 20.0.6 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'navsub' parameter in the admin dashboard, allowing authenticated users to execute arbitrary JavaScript in the context of other...

Registrations for the Events Calendar < 2.7.6 - SQL Injection

The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the eventid in the rtecsendunregisterlink AJAX action available to both unauthenticated and authenticated users before using it in a SQL statement, leading to an unauthenticated SQL injection. id:...

jenkinsci__script-security-plugin_CVE-2023-24422_1228.vd93135a_2fb_25

Script Security Plugin User’s guide adapted from information on Template plugin in CloudBees Plugins guide Various Jenkins plugins require that users define custom scripts, most commonly in the Groovy language, to customize Jenkins’s behavior. If everyone who writes these scripts is a Jenkins...

CVE-2026-92129

A flaw was found in Jenkins Script Security Plugin. Attackers with permissions to define and run sandboxed scripts, such as Pipelines, can bypass the sandbox protection. This is due to the plugin not checking calls from sandboxed scripts to methods added dynamically to a class at runtime...

CVE-2026-92127

A flaw was found in Jenkins Script Security Plugin. The plugin automatically approves classpath entries in an item's configuration when a user with administrative permissions copies the item or updates its configuration through the REST API or command-line interface CLI. This allows attackers who...

CVE-2026-92126

A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers with permission to define and run sandboxed scripts, such as Pipelines, to bypass the sandbox protection. The plugin fails to reject @Builder annotations that specify an arbitrary class in their builderStrateg...

CVE-2026-92122

A flaw was found in Jenkins Script Security Plugin. Attackers with permissions to define and run sandboxed scripts, such as Pipelines, can bypass the sandbox protection. This is achieved by coercing a value to an interface within a sandboxed script, specifically when the value inherits a method...

WordPress Security Plugin, Firewall & Malware Scanner with Auto Removal plugin < 2.191 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Karthik in WordPress Plugin Security & Malware scan by CleanTalk versions 2.191...

CVE-2026-114443

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

CVE-2026-114444

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

CVE-2026-114444 Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

EUVD-2026-113724

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

EUVD-2026-113744

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

CVE-2026-114444

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin (versions before 2.191 ) contains a vulnerability where the File System Watcher file viewer lacks proper access controls. Specifically, it does not restrict the viewer to Super Admins or only the files it legitimat...

PT-2026-133284

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

PT-2026-133285

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

CVE-2026-114444: Unknown: The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its…

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

CVE-2026-114443: Unknown: The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the…

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

Sandbox Bypass

Jenkins Script Security Plugin is vulnerable to sandbox bypass. The vulnerability is due to a failure to intercept operations on a null receiver, where method calls, property and attribute accesses, and array accesses are not checked, allowing attackers with permission to define and run sandboxed...

Sandbox Bypass

Jenkins Script Security Plugin is vulnerable to sandbox bypass. The vulnerability is due to the plugin checking the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, where this...