WordPress WP Photo Album Plus plugin < 9.2.07.002 - Reflected XSS via lbstart vulnerability

Reflected XSS via lbstart vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...

CVE-2026-19500

The Entries component in Brainstorm Force SureForms version, less than 2.1.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the...

CVE-2026-73358

Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...

CVE-2026-73366

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73350

Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...

CVE-2026-73341

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

CVE-2026-73187

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

CVE-2026-68567

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

CVE-2026-66644

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-66635

Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...

CVE-2026-66640

Contributor Cross Site Scripting XSS in Login With Ajax = 4.5.1 versions...

CVE-2026-66638

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66621

Unauthenticated Cross Site Scripting XSS in Ultimate Dashboard = 3.11.2 versions...

CVE-2026-66620

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-32474

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

CVE-2026-32553

Unauthenticated Server Side Request Forgery SSRF in OttoKit = 1.1.35 versions...

CVE-2026-32473

Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...

CVE-2026-32468

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

CVE-2026-32467

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-28567

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...