CVE-2026-15958

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

EUVD-2026-52590

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

EUVD-2026-52589

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...

CVE-2026-15233 Nested Pages < 3.2.15 - Editor+ Stored XSS via Post Title

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...

CVE-2026-15233

The Nested Pages WordPress plugin in versions before 3.2.15 is vulnerable to Stored Cross-Site Scripting (XSS) . The application fails to properly escape post titles before they are outputted into HTML attributes on an administrative listing screen. This allows users with the Editor role—or Contr...

CVE-2026-14872 Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

CVE-2026-15233

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...

CVE-2026-15233 Nested Pages < 3.2.15 - Editor+ Stored XSS via Post Title

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...

EUVD-2026-52583

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activati...

CVE-2026-12698

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activati...

CVE-2026-6837

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

EUVD-2026-52487

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

Cross-site Scripting (XSS)

Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the tagnames parameter in the /api/savecontentadmin endpoint. An attacker can inject arbitrary JavaScript that is stored and executed for eve...

PT-2026-67922

Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...

PT-2026-67717

Name of the Vulnerable Software and Affected Versions chetans9 core-php-admin-panel versions up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f Description A flaw in the processing of the file /Applications/MAMP/htdocs/core-php-admin-panel-master/customers.php allows for a remote attack. By...

PT-2026-67874

Name of the Vulnerable Software and Affected Versions Ghost versions prior to 6.54.1 Description Staff-level users can leak the hashed passwords of other staff members through the Ghost Admin API. This could allow an attacker to perform an offline password-guessing attack to potentially take over...

PT-2026-67885

Name of the Vulnerable Software and Affected Versions Ghost versions 1.20.1 through 6.54.0 Description An Administrator-level user can remotely overwrite specific files on the filesystem, which may result in integrity and availability issues. This occurs because the database export endpoint does...

PT-2026-67863

Name of the Vulnerable Software and Affected Versions Ghost versions 5.26.0 through 6.54.0 Description The Universal Import feature in Ghost Admin fails to properly sanitize imported content, which leads to Cross-Site Scripting XSS within post content. XSS is a security flaw where malicious scrip...

CVE-2026-18817: Improper Authorization

A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. Performing a manipulation results in improper...

CVE-2026-70619: Missing Authorization

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...