CVE-2026-86790

The WP Highlight Box WordPress plugin (versions through 1.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape certain shortcode attributes before they are outputted on a page where the shortcode is embedded. This flaw allows users with contributor role...

PT-2026-90581

Name of the Vulnerable Software and Affected Versions WP Highlight Box versions prior to 1.1 Description Users with the contributor role and above can perform Stored Cross-Site Scripting XSS attacks. This occurs because the plugin fails to escape certain shortcode attributes before they are outpu...

CVE-2026-86790: Improper Neutralization of Input During Web Page Generation

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Switch CTA Box plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Switch CTA Box versions = 1.1...

CVE-2026-16037

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

EUVD-2026-72853

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16037

CVE-2026-16037 is an observable timing discrepancy in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module (versions v9.0.0 through before v9.0.3) that allows a callback authentication bypass via timing attack , enabling black box reverse engineering . The CNA-assigned CVSS 3.1 score is 7.5 (HIGH)...

CVE-2026-16037: Observable Timing Discrepancy

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

PT-2026-87109

Name of the Vulnerable Software and Affected Versions PayTR Virtual Pos iFrame API WHMCS Module versions 9.0.0 through 9.0.2 Description An observable timing discrepancy exists in the PayTR Virtual Pos iFrame API WHMCS Module. This flaw allows for Black Box Reverse Engineering, a technique used t...

CVE-2026-18404

CVE-2026-18404 affects the Social Chat – Click To Chat App Button (WP WhatsApp Chat) WordPress plugin, versions up to and including 8.6.2 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by insufficient input sanitization and output escaping of the consent_message JSON attribute ...

CVE-2026-18404 Social Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18404 Social Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18404: Improper Neutralization of Input During Web Page Generation

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Social Chat plugin <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box vulnerability discovered by suyoung kimAhnLab - AhnLab in WordPress Plugin WP Social Chat versions = 8.6.2...

EUVD-2026-52277

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock publish mode : reader-reachable raw statement on read-write handle, cross-notebook read/write...

SUSE CVE-2026-82522

libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...

Linux Distros Unpatched Vulnerability : CVE-2026-82522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiti...

CVE-2026-82522

libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...

CVE-2026-82522

libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...

UBUNTU-CVE-2026-82522

libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...