EUVD-2026-91905

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-96564

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 10.2 . The root cause is insufficient input sanitization and output escaping of the Author Display Name. An unauthenticated attacker can inject ar...

CVE-2026-96564 SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-96564 SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-97343: Improper Authentication

The Burst Statistics – Simple WordPress Analytics Google Analytics Alternative plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the maybeloadshareddashboard handler issuing a genuine WordPress...

CVE-2026-96564: Improper Neutralization of Input During Web Page Generation

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

PT-2026-104550

Name of the Vulnerable Software and Affected Versions Burst Statistics – Simple WordPress Analytics Google Analytics Alternative versions prior to 3.7.2 Description Improper authentication allows for account persistence. The maybe load shared dashboard handler issues a genuine WordPress session...

PT-2026-104509

Name of the Vulnerable Software and Affected Versions SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress versions prior to 10.3 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the author display name. Unauthenticated attackers...

PT-2026-104499

Name of the Vulnerable Software and Affected Versions SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress versions prior to 10.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Sit...

CVE-2026-87973

The If-So Dynamic Content WordPress plugin (versions 1.9.9 through 1.10.1 ) is vulnerable to Stored XSS due to a failure to sanitize conversion names before storage and a failure to escape them when rendering the analytics page. This allows users with editor-level access to inject and execute arb...

CVE-2026-87973: Improper Neutralization of Input During Web Page Generation

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page...

Teen Hacker Finds Auth Flaw in Microsoft System With 17.3 Trillion Data Rows

A teen hacker found an authentication flaw in Microsoft’s Titan analytics service, where metadata indicated an estimated 17.3…...

Malicious Package

Overview analytics-widget is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-63204

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run...

EUVD-2026-87269

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run...

CVE-2026-63204

In Zammad versions prior to 7.1.2 , an authenticated user with agent permissions can exploit a vulnerability in the ticket summarize endpoint . By supplying an arbitrary AI analytics run identifier , an attacker can retrieve the AI provider error message associated with that run. This allows the ...

CVE-2026-63204 Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run...

CVE-2026-63204 Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run...

CVE-2026-97865

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

CVE-2026-97865 Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...