CVE-2026-86195: Improper Privilege Management

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write...

CVE-2026-86193: Incorrect Authorization

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative...

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are - CVE-2026-14894 CVSS score: 9.8 - A missing file type validation vulnerability in Super Forms – Drag & Drop Form...

Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin

On July 9th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Super Forms, a WordPress plugin with an estimated 13,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP...

GHSA-J8PM-GJ4C-RQ4X league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

Impact Affected versions of league/commonmark perform super-linear work on three independent parsing paths, all of which are reachable on a stock new CommonMarkConverter with default configuration and no extensions registered. Each trigger fits on a single line of input, so no complex Markdown...

SUSE CVE-2026-72340

In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by the same Super VCAP...

CVE-2026-19573

The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-68977

The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-19573 Affiliate Super Assistent <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function

The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-19573 Affiliate Super Assistent <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function

The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-19573

The Affiliate Super Assistent WordPress plugin (all versions up to and including 1.10.2 ) is affected by a Stored Cross-Site Scripting vulnerability in the doCommentShortcode function, caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary we...

CVE-2026-19573: Improper Neutralization of Input During Web Page Generation

The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-84104

The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-81768

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

CVE-2026-81768 WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

CVE-2026-81768

CVE-2026-81768 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Super Store Finder , affecting versions

EUVD-2026-68790

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

CVE-2026-81768 WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

WordPress Affiliate Super Assistent plugin <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function vulnerability

Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function vulnerability discovered by theviper17y in WordPress Plugin Affiliate Super Assistent versions = 1.10.2...

Low: python3.13

Issue Overview: Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff. CVE-2026-18503 Element.findall and fully-consumed Element.iterfind exhibit On^2 time...