CVE-2026-14207 LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...

CVE-2026-15153

The WP Hotel Booking WordPress plugin, in versions prior to 2.3.2 , is vulnerable to SQL injection due to improper sanitization and escaping of a search parameter on an administrative listing. This flaw allows users with booking-management roles to execute arbitrary SQL queries. While the vulnera...

CVE-2026-15153 WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

CVE-2026-15153 WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

CVE-2026-15153

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

EUVD-2026-50990

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

CVE-2026-15235 Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account Subscriber and above to read the personal data, including name...

EUVD-2026-50986

The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in...

Exploit for CVE-2026-49865

Kimai CVE-2026-52824 — Default APPSECRET Authentication Bypas...

CVE-2026-14356 FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint

The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-16610 Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key

The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...

CVE-2026-16610 Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key

The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...

CVE-2026-16610

CVE-2026-16610 , for the Admin and Site Enhancements (ASE) Pro WordPress plugin, is documented as allowing unauthenticated remote code execution in all versions up to 8.9.0 via the recursive_html function. The root cause is a vulnerable frontend save handler that relies on a publicly emitted nonc...

EUVD-2026-50966

The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-52539

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

CVE-2025-65341: Improper Neutralization of Input During Web Page Generation

Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting XSS in admin/editproduct.php...

PT-2026-66578

Name of the Vulnerable Software and Affected Versions Ecommerce Fruits Bazar version 1.0 Description Cross Site Scripting XSS occurs in the 'admin/edit product.php' endpoint. XSS is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. Recommendations At...

PT-2026-66348

Name of the Vulnerable Software and Affected Versions ADM versions 4.1.0 through 4.3.3.RUN1 ADM versions 5.0.0 through 5.1.3.RI81 Description A stored format string vulnerability exists in the FTP Backup feature. This occurs when user-controlled backup configuration data is written to a task log...

PT-2026-66628

Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard affected versions not specified Description A stored cross-site scripting issue exists that allows unauthenticated remote attackers to execute arbitrary JavaScript in an administrator's browser session. This occurs when HTML...

CVE-2026-65834: Improper Input Validation

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...