CVE-2026-6041

The Buzz Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom Buzz Avatar' buzzcommentsavatarimage setting in all versions up to, and including, 0.9.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-6041 Buzz Comments <= 0.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Buzz Avatar' Setting

The Buzz Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom Buzz Avatar' buzzcommentsavatarimage setting in all versions up to, and including, 0.9.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

PT-2026-34285

Name of the Vulnerable Software and Affected Versions CalJ versions prior to 1.6 Description The CalJ plugin for WordPress contains a missing authorization flaw. The CalJSettingsPage class constructor processes the 'save-obtained-key' operation from POST data without verifying if the user possess...

PT-2026-34307

Name of the Vulnerable Software and Affected Versions Posts map plugin for WordPress versions prior to 0.1.4 Description Insufficient input sanitization and output escaping on user supplied attributes allow authenticated attackers with contributor-level access and above to inject arbitrary web...

PT-2026-34310

Name of the Vulnerable Software and Affected Versions Fast & Fancy Filter – 3F plugin for WordPress versions prior to 1.2.3 Description Cross-Site Request Forgery occurs due to missing nonce verification in the saveFields function, which handles the 'fff save settins' AJAX action. This allows...

PT-2026-34273

Name of the Vulnerable Software and Affected Versions Private WP suite versions prior to 0.4.2 Description The Private WP suite plugin for WordPress contains a Stored Cross-Site Scripting issue within the 'Exceptions' setting. This occurs because of insufficient input sanitization and output...

PT-2026-34607

Name of the Vulnerable Software and Affected Versions OpenMcdf affected versions not specified Description OpenMcdf fails to detect cycles in the directory entry red-black tree of a Compound File Binary CFB document. A crafted CFB file containing a cycle in the LeftSiblingID or RightSiblingID cha...

PT-2026-35428

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.32 n8n versions prior to 2.17.4 n8n versions prior to 2.18.1 Description A flaw in the xml2js library used to parse XML request bodies in the webhook handler allows prototype pollution via a crafted XML payload...

PT-2026-34453

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.22.1 Description A user possessing the write:admin role in one Keycloak realm can utilize the Manager API to update Keycloak realm roles for users in a different realm, including the master realm. The issue exist...

PT-2026-34534

Name of the Vulnerable Software and Affected Versions iOS versions prior to 18.7.8 iOS versions prior to 26.4.2 iPadOS versions prior to 18.7.8 iPadOS versions prior to 26.4.2 Description A logging issue in the Notification Services system component allowed notifications marked for deletion to be...

PT-2026-35041

Name of the Vulnerable Software and Affected Versions rust-openssl versions 0.9.24 through 0.10.77 Description FFI trampolines behind the functions set psk client callback, set psk server callback, set cookie generate cb, and set stateless cookie generate cb in SslContextBuilder forward the user...

PT-2026-34295

Name of the Vulnerable Software and Affected Versions DX Unanswered Comments versions prior to 1.8 Description The DX Unanswered Comments plugin for WordPress is susceptible to Cross-Site Request Forgery. This issue occurs because of missing nonce validation on the settings form within the...

PT-2026-34298

Name of the Vulnerable Software and Affected Versions Sentence To SEO versions prior to 1.1 Description The Sentence To SEO plugin for WordPress contains a Stored Cross-Site Scripting issue. The problem occurs because the plugin fails to properly sanitize input and escape output for the 'Permanen...

PT-2026-34287

Name of the Vulnerable Software and Affected Versions Create DB Tables versions prior to 1.2.2 Description The Create DB Tables plugin for WordPress contains an authorization bypass. The plugin registers admin post action hooks for creating tables 'admin post add table' and deleting tables 'admin...

PT-2026-34241

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The implementation of TIOCNOTTY fails to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If the...

PT-2026-34299

Name of the Vulnerable Software and Affected Versions Bread & Butter versions prior to 8.2.0.26 Description Stored Cross-Site Scripting is possible via the 'breadbutter-customevent-button' shortcode. The customEventShortCodeButton function fails to apply proper input sanitization and output...

PT-2026-34297

Name of the Vulnerable Software and Affected Versions Ni WooCommerce Order Export versions prior to 3.1.7 Description An issue exists where missing nonce validation in the ni order export action AJAX handler function allows unauthenticated attackers to modify plugin settings via a forged request...

PT-2026-34283

Name of the Vulnerable Software and Affected Versions Twittee Text Tweet versions prior to 1.0.9 Description Insufficient input sanitization and output escaping in the ttt twittee tweeter function allow authenticated attackers with Contributor-level access and above to inject arbitrary web script...

WordPress plugin DX Unanswered Comments 跨站请求伪造漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

PT-2026-34596

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.5.0 Description A Stored DOM XSS Cross-Site Scripting issue exists in the backup module. An attacker can manipulate the filename field using an SQL file to inject a hidden XSS payload, potentially leading to full...