EUVD-2026-68972

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...

CVE-2026-75965 User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...

CVE-2026-75965: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...

CVE-2026-83609: XML Injection (aka Blind XPath Injection)

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-13203: Improper Neutralization of Input During Web Page Generation

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customid' shortcode attribute of the dslcmodulessection and dslcmodulesarea shortcodes in versions up to, and including, 2.1.19. This is due to insufficient input...

EasyAppointments 1.5.1 Blind SQL Injection

A blind SQL injection vulnerability exists in the orderby parameter of the /index.php/customers/search endpoint in EasyAppointments versions 1.5.1 and below. The parameter is passed unsanitized to CodeIgniter 3 Query Builder orderby. Parenthesized subqueries bypass backtick escaping via CI3's...

PT-2026-84391

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounde...

CVE-2026-72682: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounde...

CVE-2026-15101: Improper Neutralization of Input During Web Page Generation

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

PT-2026-84132

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-16786: Improper Neutralization of Input During Web Page Generation

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-75964: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-16787: Improper Neutralization of Input During Web Page Generation

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslccustomfield' Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-19948: Missing Authorization

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-16788: Improper Neutralization of Input During Web Page Generation

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-84110

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...

EasyAppointments 1.5.1 - Blind SQL Injection

Exploit Title: EasyAppointments 1.5.1 - Blind SQL Injection Google Dork: N/A backend login required Date: 07/27/2026 Exploit Author: Michael Chesang Vendor Homepage: https://easyappointments.org Software Link: https://github.com/alextselegidis/easyappointments/releases Version: = 1.5.1 REQUIRED...

PT-2026-84116

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

@pnpm/deps.compliance.commands (1000.0.0), @pnpm/exec.commands (1001.0.15) +13 more potentially affected by CVE-2026-82392 via @pnpm/deps.graph-builder (>=1002.2.0, <=1002.3.16)

@pnpm/deps.graph-builder NPM version =1002.2.0, =1001.1.26, =1004.2.0, =1000.3.1, =1000.2.17, =1.1.0, =1.0.1, =0.0.0-77fa1de9f5d7a6024117b3b9e26c48de32990ffe, =1.1.0, =1.1.2 Source cves: CVE-2026-82392 Source advisory: SNYK:JS-PNPMDEPSGRAPHBUILDER-19477021...

@pnpm/building.commands (>=1100.0.0, <=1100.1.7), @pnpm/deps.compliance.commands (>=1100.0.0, <=1101.5.0) +9 more potentially affected by CVE-2026-82392 via @pnpm/deps.graph-builder (>=1100.0.0, <=1100.0.18)

@pnpm/deps.graph-builder NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =0.0.1, =0.0.21 Source cves: CVE-2026-82392 Source advisory: SNYK:JS-PNPMDEPSGRAPHBUILDER-19477021...