WordPress Church Admin plugin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by 刀 妖 in WordPress Plugin Church Admin versions = 5.1.2...

GHSA-P3PR-8F3M-4QP8 pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

Summary pyLoad ships the WindowsPhoneNotify addon, whose send method opens an HTTP connection to a host taken directly from the plugin's pushurl configuration value. A user holding the standard non-admin SETTINGS permission can set pushurl and pushid and enable the addon through the web API, sinc...

WordPress ACF Frontend Admin by DynamiApps: Cross-site Script Vulnerability

WordPress ACF Frontend Admin by DynamiApps version 3.28.36 and earlier has a cross-site scripting vulnerability. This vulnerability stems from the getdynamicvalues function’s text-level search and replacement operation on content, without proper HTML parsing. As a result, authenticated attackers...

WordPress ACF Frontend Admin by DynamiApps: SQL Injection Vulnerability

WordPress ACF Frontend Admin by DynamiApps version 3.29.13 and earlier has an SQL injection vulnerability. This vulnerability can be exploited by attackers with administrator privileges, allowing them to execute SQL injections and potentially lead to the disclosure of sensitive database informati...

CVE-2026-108111

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or ispublic filtering, to list enabled private workflows in the sa...

BIT-GHOST-2026-104416 Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges...

BIT-GHOST-2026-104415 Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not...

BIT-GHOST-2026-104414 Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost...

BIT-GHOST-2026-104413 Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

BIT-GHOST-2026-103292 Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

BIT-GHOST-2026-103284 Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without...

BIT-GHOST-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

BIT-GHOST-2026-103278 Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

BIT-GHOST-2026-103277 Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...

BIT-GHOST-2026-103275 Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...

CVE-2026-94158

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bkninja Gloria Admin Panel gloria-admin-panel allows Reflected XSS.This issue affects Gloria Admin Panel: from n/a through 1.3...

CVE-2026-94158

The bkninja Gloria Admin Panel WordPress plugin (versions

CVE-2026-94158 WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bkninja Gloria Admin Panel gloria-admin-panel allows Reflected XSS.This issue affects Gloria Admin Panel: from n/a through 1.3...

CVE-2026-94158 WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bkninja Gloria Admin Panel gloria-admin-panel allows Reflected XSS.This issue affects Gloria Admin Panel: from n/a through 1.3...

EUVD-2026-95634

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bkninja Gloria Admin Panel gloria-admin-panel allows Reflected XSS.This issue affects Gloria Admin Panel: from n/a through 1.3...