CVE-2026-4766 Easy Image Gallery <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Meta

The Easy Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery shortcode post meta field in all versions up to, and including, 1.5.3. This is due to insufficient input sanitization and output escaping on user-supplied gallery shortcode values. This makes ...

EUVD-2026-15181

The Easy Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery shortcode post meta field in all versions up to, and including, 1.5.3. This is due to insufficient input sanitization and output escaping on user-supplied gallery shortcode values. This makes ...

PT-2026-28013

Name of the Vulnerable Software and Affected Versions QuantumCloud ChatBot versions through 7.7.9 Description A flaw exists in QuantumCloud ChatBot that allows for Blind SQL Injection due to improper neutralization of special elements used in an SQL command. This issue could potentially allow an...

PT-2026-27867

Name of the Vulnerable Software and Affected Versions NooTheme CitiLights versions through 3.7.1 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. Recommendations Update NooTheme CitiLights to a version later than 3.7.1...

PT-2026-27865

Name of the Vulnerable Software and Affected Versions Elated Listing versions n/a through 1.4 Description A missing authorization flaw exists in Elated-Themes Elated Listing eltd-listing. This issue stems from incorrectly configured access control security levels, potentially allowing unauthorize...

PT-2026-27806

CVE-2025-69096 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in G5Theme Zorka zorka allows Reflected XSS.This issue affects Zork… https://t.co/7vIIzsCyr0...

PT-2026-27981

Name of the Vulnerable Software and Affected Versions ThemeREX Love Story versions n/a through 1.3.12 Description An issue exists in ThemeREX Love Story that allows for object injection due to deserialization of untrusted data. This impacts the application's ability to securely handle data input...

PT-2026-27944

Name of the Vulnerable Software and Affected Versions Nexa Blocks versions through 1.1.1 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. This issue impacts Nexa Blocks. Recommendations Update Nexa Blocks to a version later than...

PT-2026-28058

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Taboola Taboola Pixel taboola-pixel allows Reflected XSS.This issue affects Taboola Pixel: from n/a through = 1.1.4...

PT-2026-27807

Name of the Vulnerable Software and Affected Versions WPSubscription versions through 1.8.10 Description An authorization bypass exists in Convers Lab WPSubscription due to incorrectly configured access control security levels. This allows exploitation through a user-controlled key. Recommendatio...

PT-2026-27866

Name of the Vulnerable Software and Affected Versions NooTheme CitiLights versions through 3.7.1 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Reflected Cross-site Scripting XSS condition. This allows for the injection of...

PT-2026-27874

Name of the Vulnerable Software and Affected Versions NooTheme Visionary Core versions n/a through 1.4.9 Description An issue exists in NooTheme Visionary Core that allows for object injection due to deserialization of untrusted data. This impacts the noo-visionary-core component. Recommendations...

PT-2026-28021

Name of the Vulnerable Software and Affected Versions Elated-Themes Leroux versions prior to 1.4 Description An issue exists in Elated-Themes Leroux that allows for object injection due to the deserialization of untrusted data. This impacts the software's ability to securely handle data input...

PT-2026-28025

Name of the Vulnerable Software and Affected Versions Mikado-Themes Stål versions prior to 1.7 Description The software contains a flaw due to deserialization of untrusted data, which can lead to object injection. This issue impacts the Stål component. Recommendations Update Mikado-Themes Stål to...

WordPress plugin Comments Import & Export 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-27858

Name of the Vulnerable Software and Affected Versions News Magazine X versions through 1.2.50 Description An authorization issue exists in News Magazine X, allowing exploitation of incorrectly configured access control security levels. Recommendations Update News Magazine X to a version later tha...

PT-2026-27849

Name of the Vulnerable Software and Affected Versions bdthemes Ultimate Post Kit versions through 4.0.21 Description An authorization issue exists in bdthemes Ultimate Post Kit, allowing exploitation due to incorrectly configured access control security levels. The issue impacts the...

PT-2026-27838

Name of the Vulnerable Software and Affected Versions G5Theme Handmade Framework versions through 3.9 Description The software contains a flaw related to improper input handling during web page creation, leading to a Reflected Cross-Site Scripting XSS condition. This allows an attacker to inject...

PT-2026-27870

Name of the Vulnerable Software and Affected Versions NooTheme Organici Library versions through 2.1.2 Description The NooTheme Organici Library contains a flaw related to improper neutralization of special elements within SQL commands, leading to a Blind SQL Injection issue. This allows for...

PT-2026-28050

Unrestricted Upload of File with Dangerous Type vulnerability in halfdata Green Downloads halfdata-paypal-green-downloads allows Using Malicious Files.This issue affects Green Downloads: from n/a through = 2.08...