EUVD-2026-59849

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-18432

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-2487

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

EUVD-2026-59847

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-2487 Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-2487

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-2487

CVE-2026-2487 concerns the WordPress plugin “Admin Custom Login.” The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in admin settings, affecting all versions up to and including 3.6.4. The root cause is insufficient input sanitization and output escaping, allowing an authenticated att...

CVE-2026-2487 Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

EUVD-2026-59798

SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/ surface, accepts the workspace access code Conf.AccessAuthCode as the Basic Auth password but never consults the...

CVE-2026-12477: Improper Neutralization of Input During Web Page Generation

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2026-73081

Name of the Vulnerable Software and Affected Versions Gravity Booster – Styles & Layouts for Gravity Forms versions prior to 5.27 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the admin settings. Authenticated attackers with...

PT-2026-73100

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.30.0 Description This issue allows for privilege escalation due to improper authorization checks in the ActionUser::conditions logic function. The authorization check current user can'edit user'...

PT-2026-73088

Name of the Vulnerable Software and Affected Versions Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution versions prior to 5.4.13 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows...

CVE-2026-2487: Improper Neutralization of Input During Web Page Generation

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

PT-2026-73107

Name of the Vulnerable Software and Affected Versions Toocheke Companion versions prior to 2.11 Description The Toocheke Companion plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the toocheke series bg color save function fails to properly sanitize input fro...

CVE-2026-18432: Improper Privilege Management

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

PT-2026-73143

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth middleware. The middleware accepts the API token Conf.Api.Token via an Authorization header Token/Bearer or a ?token= query parameter, and neither path is...

PT-2026-73077

Name of the Vulnerable Software and Affected Versions Admin Custom Login versions prior to 3.6.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the admin settings. This allows authenticated attackers with administrator-level...