CVE-2026-17011: Insufficient Verification of Data Authenticity

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing...

PT-2026-68752

Name of the Vulnerable Software and Affected Versions Mermaid versions prior to 10.9.8 Mermaid versions prior to 11.16.1 Description Mermaid is vulnerable to CSS injection through sibling combinator selectors generated from class or id names provided in the diagram text. The software fails to ful...

CVE-2026-8879

Version 3.0.7 of the Securly Chrome Extension is vulnerable to a security flaw where it dynamically registers content13.min.js as a content script at runtime via chrome.scripting.registerContentScripts(). Because this script is not declared in the manifest.json file, it bypasses the Chrome Web St...

CVE-2021-42749

In Beaver Themer, attackers can bypass conditional logic controls for hiding content when viewing the post archives. Exploitation requires that a Themer layout is applied to the archives, and that the post excerpt field is not set...

PT-2022-11675

Name of the Vulnerable Software and Affected Versions Beaver Themer affected versions not specified Description The issue allows attackers to bypass conditional logic controls for hiding content when viewing post archives. This can be exploited if a Themer layout is applied to the archives and th...