CVE-2026-97258 WordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in Aruba Migration Tool = 1.0.4 versions...

WordPress Awesome Support – WordPress HelpDesk & Support Plugin plugin <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Nhien Pham nhienit nhienit in WordPress Plugin Awesome Support versions = 6.4.0...

WordPress bbp style pack plugin <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by zickzick2 in WordPress Plugin bbp style pack versions = 6.4.8...

BIT-PARSE-2026-100632 Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply...

WordPress Redux Framework plugin <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Redux Framework versions = 4.5.14...

CVE-2026-96268

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-89424

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-90992

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2026-101925

The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...

CVE-2026-89424

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.5.6 . The root cause is insufficient input sanitization and output escaping involving the 'noti_token' parameter. An authenticated attacker with Subscriber-level access (or...

CVE-2026-89424 Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-89424 Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

EUVD-2026-90573

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

EUVD-2026-90569

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-96268 Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-96268

The Awesome Support – WordPress HelpDesk & Support Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.4.0 . The root cause is insufficient input sanitization and output escaping of the 'gdpr-data' parameter within the wpas_gdpr_user_opt_o...

EUVD-2026-90567

The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...

CVE-2026-101925 bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name

The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...

CVE-2026-101925

The bbp style pack plugin for WordPress (versions up to and including 6.4.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the display_name (via /wp-admin/profile.php) and bbp_reply_content (via bbPress reply form) p...

CVE-2026-90992 Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...