CVE-2026-102971

CVE-2026-102971: hidden revision author ID disclosure Reporter: Marco Paciaroni BomboBombone. MediaWiki's RESTBase-compatible revision response could include the numeric user ID of an author whose name had been hidden. The response still set usertext to null and marked the author as hidden, but t...

pafish

Pafish Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do. The project is free and open source; the code of all the anti-analysis techniques is publicly available. Pafish executables for...

CVE-2026-113500

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose commen...

CVE-2026-113499

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment ...

CVE-2026-110510

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages...

CVE-2026-113499

The LiteSpeed Cache WordPress plugin (versions before 7.9.2 ) is vulnerable to an unauthenticated stored XSS via CDN inline CSS rewriting. The root cause is that the plugin fails to restrict an HTML rewriting routine to stylesheet content, causing it to remove a quote that terminates an attribute...

CVE-2026-113499 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment ...

EUVD-2026-108599

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment ...

WordPress Essential Addons for Elementor plugin < 6.8.7 - Author+ Content Injection vulnerability

Author+ Content Injection vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Essential Addons for Elementor versions 6.8.7...

PT-2026-121772

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment ...

PT-2026-121763

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages...

PT-2026-121773

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose commen...

CVE-2026-111972

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

CVE-2026-111972

The Photo Engine (Media Organizer & Lightroom) WordPress plugin, in versions before 6.5.8 , contains an authorization bypass vulnerability. The plugin fails to verify if a user is authorized to act on a targeted media attachment. This allows authenticated users with the author role or higher to d...

EUVD-2026-108017

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

EUVD-2026-108016

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site...

CVE-2026-111972 Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

CVE-2026-114407

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parsestr and concatenated unescaped into a rendered input tag via the form...

CVE-2026-114407 e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parsestr and concatenated unescaped into a rendered input tag via the form...

CVE-2026-114407

The e107 CMS before version 2.3.13 is vulnerable to a reflected cross-site scripting (XSS) flaw. The issue resides in search.php when the author GET parameter is processed using parse_str(). Because the data is concatenated unescaped into a rendered input tag via the form handler's 'other' option...