CVE-2026-94264 Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output...

EUVD-2026-108603

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output...

CVE-2026-94264

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins (versions before 0.9.2.8 ) are vulnerable to Cross-Site Scripting (XSS) . The root cause is a failure to validate or escape certain form shortcode attributes , which can be manipulated using values fro...

CVE-2026-113500 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose commen...

CVE-2026-113500

The LiteSpeed Cache WordPress plugin (versions before 7.9.2 ) is vulnerable to an unauthenticated stored XSS vulnerability. The issue stems from an HTML optimization routine that fails to limit its scope to stylesheet content, potentially deleting the markup that closes attributes in the rendered...

CVE-2026-113500 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose commen...

EUVD-2026-108594

The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged...

CVE-2026-109933

The Otter Blocks WordPress plugin, in versions prior to 3.2.8 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient sanitization and escaping of user-supplied block styling values before they are written into an inline stylesheet . This allows users with ...

CVE-2026-109933 Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...

CVE-2026-109933 Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...

PT-2026-121776

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output...

PT-2026-121767

The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged...

Linux Distros Unpatched Vulnerability : CVE-2026-98929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in...

CVE-2026-115519

Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not...

SUSE CVE-2026-114728

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml detected the CSS url token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for...

CVE-2026-66281

In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition infinite loop. These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted...

CVE-2026-66281

EmberZNet versions 9.1.1 and earlier are vulnerable to a resource management error where a malformed Discover Attributes command can trigger an infinite loop with an unreachable exit condition. This issue specifically impacts devices that support manufacturer-specific clusters and requires the tr...

CVE-2026-66281 Authenticated Denial-of-Service in Zigbee Discover Attributes Handling

In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition infinite loop. These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted...

EUVD-2026-108181

In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition infinite loop. These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted...

CVE-2026-66281 Authenticated Denial-of-Service in Zigbee Discover Attributes Handling

In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition infinite loop. These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted...