PT-2026-84001

Name of the Vulnerable Software and Affected Versions Print Barcode Labels for your WooCommerce products/orders versions prior to 4.0.1 Description This issue involves the exposure of sensitive subscriber data within the plugin. Recommendations Update to a version newer than 4.0.0...

OPENSUSE-SU-2026:21681-1 Security update for rav1e

This update for rav1e fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted log input can allow ANSI escape sequence injection and terminal manipulation bsc1249016. Changes for rav1e: - Update cargo dependencies...

SUSE-SU-2026:23567-1 Security update for rav1e

This update for rav1e fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted log input can allow ANSI escape sequence injection and terminal manipulation bsc1249016. Changes for rav1e: - Update cargo dependencies...

CVE-2026-17520

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails,...

CVE-2026-18234 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...

CVE-2026-16600

The SmartAIPress WordPress plugin (versions

CVE-2026-18233 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

WordPress SmartAIPress plugin <= 1.2.0 - Subscriber+ Server-Side Request Forgery vulnerability

Subscriber+ Server-Side Request Forgery vulnerability discovered by Benjamin Aguayo in WordPress Plugin SmartAIPress versions = 1.2.0...

EUVD-2026-68043

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-18233 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

CVE-2026-18233

The MStore API WordPress plugin in versions before 4.21.1 is vulnerable to an authorization bypass. The plugin fails to verify that an order targeted by one of its delivery endpoints belongs to the requester. This flaw allows any authenticated user , including those with Subscriber privileges, to...

WordPress MStore API plugin < 4.21.1 - Subscriber+ Arbitrary Order Completion vulnerability

Subscriber+ Arbitrary Order Completion vulnerability discovered by Erwan LR WPScan in WordPress Plugin MStore API versions 4.21.1...

CVE-2026-16600 SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-16600 SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

Malicious Package

Overview ux-metrics-client-interaction-subscriber is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...

PT-2026-83417

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.11 Description The plugin fails to perform a capability check on an AJAX action. This allows any authenticated user, including those with subscriber-level privileges, to delete arbitrary...

CVE-2026-16600: Server-Side Request Forgery (SSRF)

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

PT-2026-83395

Name of the Vulnerable Software and Affected Versions SmartAIPress versions prior to 1.2.1 Description Users with subscriber-level access and above can perform a full-read Server-Side Request Forgery SSRF, a condition where an attacker forces a server to make requests to an unintended location...

MAL-2026-15545 Malicious code in ux-metrics-client-interaction-subscriber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...

Malicious code in ux-metrics-client-interaction-subscriber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...