CVE-2026-126697

The Quick Page/Post Redirect WordPress plugin (versions before 5.2.4 ) was distributed with a hidden update mechanism that bypassed WordPress.org to fetch updates from a private server. This allowed an attacker to push a backdoored build (version 5.2.3) that injected a the_content filter. The bac...

EUVD-2026-125869

The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that fetched Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 updates from its author's own server instead of WordPress.org, which was used to push a backdoored build to...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CLEANSTART-2026-PB94569 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

CVE-2026-126814: blueprintue blueprintue-self-hosted-edition: blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users…

blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider. Attackers can set a blueprint video URL on an...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CLEANSTART-2026-BV12250 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

CLEANSTART-2026-TN12914 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

CVE-2026-116410

Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS = 3.4.3 versions...

CVE-2026-116410

The Masteriyo - LMS WordPress plugin (versions

EUVD-2026-114306

Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS = 3.4.3 versions...

CVE-2026-116410 WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability

Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS = 3.4.3 versions...

CVE-2026-116410 WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability

Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS = 3.4.3 versions...

CLEANSTART-2026-AJ79514 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability

WordPress Masteriyo - LMS plugin = 3.4.3 - Arbitrary Content Deletion vulnerability discovered by Sakri Koskimies Saggre in WordPress Plugin Masteriyo - LMS versions = 3.4.3...

CVE-2026-116410: masteriyo Masteriyo - LMS: Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.

Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS = 3.4.3 versions...

PT-2026-133756

Name of the Vulnerable Software and Affected Versions Masteriyo - LMS versions prior to 3.4.4 Description An issue allows unauthenticated users to perform arbitrary content deletion. Recommendations Update Masteriyo - LMS to version 3.4.4 or later...

WordPress Photo Engine (Media Organizer & Lightroom) plugin < 6.6.0 - Author+ Arbitrary Content Modification vulnerability

Author+ Arbitrary Content Modification vulnerability discovered by Mahammad Mammadov in WordPress Plugin Photo Engine versions 6.6.0...

CLEANSTART-2026-DE92020 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...