EUVD-2026-68043

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-16600

The SmartAIPress WordPress plugin (versions

CVE-2026-16600: Server-Side Request Forgery (SSRF)

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

PT-2026-83417

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.11 Description The plugin fails to perform a capability check on an AJAX action. This allows any authenticated user, including those with subscriber-level privileges, to delete arbitrary...

CVE-2026-55779

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

CVE-2026-55779 Silverstripe Versioned: XSS in archive admin restore

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

CVE-2026-39070

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

CVE-2026-55673

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...

EUVD-2026-67464

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

CVE-2026-16759

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

CVE-2026-39070: Improper Neutralization of Input During Web Page Generation

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

VulnCheck KEV: CVE-2026-16759

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

CVE-2026-39070

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

CVE-2026-39070

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

CVE-2026-39070

The Bit Assist WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in its Call-To-Action feature. This flaw affects versions 1.7.1 and lower , where an authenticated attacker with administrator privileges can insert a malicious payload into a widget's Call-To-Action form field. On...

EUVD-2026-67902

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

PT-2026-83172

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

PT-2026-83368

Name of the Vulnerable Software and Affected Versions Silverstripe Versioned versions prior to 3.2.1 Description In the RestoreAction::getRestoreMessage function within src/RestoreAction.php, restore notifications in ArchiveAdmin are rendered as CAST HTML. The system fails to apply Convert::raw2x...

CVE-2026-76649: NULL Pointer Dereference

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly. Successful exploitation may result in a...

CVE-2026-78138

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...