CVE-2026-13157 Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

CVE-2026-13157

The Theme Demo Import WordPress plugin (versions false override in $upload_overrides. This allows high-privilege users, such as default site administrators or non-super-admin site administrators in a Multisite architecture, to bypass restrictions and upload executable PHP scripts (e.g., .php, .p...

WordPress Admin Columns for ACF Fields plugin <= 0.3.2 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Shivamani Vastrala in WordPress Plugin Admin Columns for ACF Fields versions = 0.3.2...

CVE-2026-14596 DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

WordPress Bit Form plugin < 3.1.4 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Bit Form versions 3.1.4...

CVE-2026-14596 DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

CVE-2025-15669 Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label

The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users such as administrators, who do not hold the unfilteredhtml capability on multisite to store JavaScript that...

CVE-2026-15932 Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal

The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server...

CVE-2026-14164 affecting package libarchive for versions less than 3.7.7-7

CVE-2026-14164 affecting package libarchive for versions less than 3.7.7-7. A patched version of the package is available...

EUVD-2026-51725

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any...

CVE-2026-56852 affecting package kata-containers for versions less than 3.19.1.kata3-7

CVE-2026-56852 affecting package kata-containers for versions less than 3.19.1.kata3-7. A patched version of the package is available...

CVE-2026-41606 affecting package thrift for versions less than 0.24.0-1

CVE-2026-41606 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-58662 affecting package thrift for versions less than 0.24.0-1

CVE-2026-58662 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-41607 affecting package thrift for versions less than 0.24.0-1

CVE-2026-41607 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-32597 affecting package python-jwt for versions less than 2.13.0-1

CVE-2026-32597 affecting package python-jwt for versions less than 2.13.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55969 affecting package thrift for versions less than 0.24.0-1

CVE-2026-55969 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55970 affecting package thrift for versions less than 0.24.0-1

CVE-2026-55970 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-49158 affecting package thrift for versions less than 0.24.0-1

CVE-2026-49158 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-43871 affecting package thrift for versions less than 0.24.0-1

CVE-2026-43871 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-41608 affecting package thrift for versions less than 0.24.0-1

CVE-2026-41608 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...