PT-2026-86804

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-14444: Improper Privilege Management

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-14975

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2026-14975

The WP File Download WordPress plugin (all versions up to and including 6.3.8 ) is vulnerable to Directory Traversal via the remoteurl parameter, discovered by 0xd4rk5id3 (EnvoraSec). An authenticated attacker with Subscriber-level access first poisons the _wpfd_file_metadata['file'] post-meta va...

EUVD-2026-71881

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2026-14975 WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2026-14975 WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

SUSE CVE-2026-80893

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork copyhugetlbpagerange clears the uffd-wp bit of migration and hwpoison entries with hugepteclearuffdwp, which operates on the present-PTE bit position. Swap entri...

PT-2026-86318

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2026-83627: Improper Control of Generation of Code

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the logmsg function in core/modules/class-page-cache.php. The page-cache debug log is written to...

CVE-2026-14975: Improper Limitation of a Pathname to a Restricted Directory

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

WordPress WP File Download plugin <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter vulnerability

Authenticated Subscriber+ Arbitrary File Read via Path Traversal in 'remoteurl' Parameter vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin WP File Download versions = 6.3.8...

WordPress Social Chat plugin <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box vulnerability discovered by suyoung kimAhnLab - AhnLab in WordPress Plugin WP Social Chat versions = 8.6.2...

AZL-99609 CVE-2026-80893 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork copyhugetlbpagerange clears the uffd-wp bit of migration and hwpoison entries with hugepteclearuffdwp, which operates on the present-PTE bit position. Swap entri...

CVE-2026-80893

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork copyhugetlbpagerange clears the uffd-wp bit of migration and hwpoison entries with hugepteclearuffdwp, which operates on the present-PTE bit position. Swap entri...

CVE-2026-80893

CVE-2026-80893 is a Linux kernel vulnerability in the mm/hugetlb subsystem. The root cause lies in copy_hugetlb_page_range(), which clears the userfaultfd write-protect (uffd-wp) bit on swap entries using huge_pte_clear_uffd_wp(). This function operates on the present-PTE bit position, but swap e...

CVE-2026-80893 mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork copyhugetlbpagerange clears the uffd-wp bit of migration and hwpoison entries with hugepteclearuffdwp, which operates on the present-PTE bit position. Swap entri...

EUVD-2026-71643

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork copyhugetlbpagerange clears the uffd-wp bit of migration and hwpoison entries with hugepteclearuffdwp, which operates on the present-PTE bit position. Swap entri...

CVE-2026-80893 mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork copyhugetlbpagerange clears the uffd-wp bit of migration and hwpoison entries with hugepteclearuffdwp, which operates on the present-PTE bit position. Swap entri...

CVE-2026-80893

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork copyhugetlbpagerange clears the uffd-wp bit of migration and hwpoison entries with hugepteclearuffdwp, which operates on the present-PTE bit position. Swap entri...