PT-2026-98261

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description An authenticated attacker can execute arbitrary JavaScript in the browsers of other users via a stored client-side template injection. By injecting Vue.js template expressions into the lead title...

CVE-2026-48540: Improper Neutralization of Input During Web Page Generation

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

plone.app.dexterity has a Denial of Service due to excessive title or description length

Impact When creating content with a very large title or description field, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.dexterity. On Plone 6.2, upgrade to...

GHSA-5426-92W4-WVHV plone.app.dexterity has a Denial of Service due to excessive title or description length

Impact When creating content with a very large title or description field, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.dexterity. On Plone 6.2, upgrade to...

WordPress WP Recipe Maker plugin < 10.8.2 - Subscriber+ Non-Public List Title Disclosure vulnerability

Subscriber+ Non-Public List Title Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin WP Recipe Maker versions 10.8.2...

CVE-2026-86603 WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...

CVE-2026-57576 plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length

plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0...

CVE-2026-57576

The plone.app.dexterity and plone.app.contenttypes components of the Plone content management system are vulnerable to a denial of service (DoS) attack. An authenticated user can trigger this by creating content with excessively long titles , descriptions, or uploaded-file names, which causes the...

CVE-2026-57576 plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length

plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0...

CVE-2026-85680

The Ultimate Member WordPress plugin (versions before 2.13.1 ) is vulnerable to an unauthenticated stored XSS flaw. The root cause is the failure to escape values derived from user-supplied profile names before they are output in the page title, combined with the decoding of HTML entities after s...

CVE-2026-85680 Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to sto...

EUVD-2026-83504

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to sto...

CVE-2026-85680 Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to sto...

PT-2026-95764

Name of the Vulnerable Software and Affected Versions Secure Custom Fields WordPress plugin versions prior to 6.9.4 Description An issue exists where the plugin fails to properly verify that a front-end form submission matches the form rendered to the visitor. This allows unauthenticated users to...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

WordPress Core <= 7.1 - Author+ Private Parent Post Title Disclosure vulnerability

Author+ Private Parent Post Title Disclosure vulnerability discovered by HDWSec in WordPress core versions = 7.1...

PT-2026-95340

Name of the Vulnerable Software and Affected Versions Popup Maker versions prior to 1.25.0 Description The Popup Maker plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level...

WP < 7.1.1 - Author+ Unpublished Post Title Disclosure via Attachment Edit Screen

Description WordPress does not check that the user is allowed to read an attachment's parent post before displaying its title on an admin screen in some cases, which could allow users with a role as low as author to learn the title of a private or draft post they cannot access...

WP < 7.1.1 - Contributor+ Unpublished Post Title Disclosure

Description WordPress does not check that the user is allowed to access a post before returning its sample permalink in some cases, which could allow users with a role as low as contributor to retrieve the titles of other users' draft and pending posts...

CVE-2026-92986 SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...