WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. id: CVE-2019-17233 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated HTML Content Injection author: daffainfo severity: medium description: | Functions/EWDUFAQImport.ph...

ids_bypass

Disclaimer These programs is for Educational purpose ONLY. Do not use it without permission. injectserver: Proof-Of-Concept for CVE-2018-6794. If as a server side you break a normal TCP 3 way handshake packets order and inject some response data before 3whs is complete then data still will be...

CVE-2026-42694

The Kirki WordPress plugin (versions

CVE-2026-116402 WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9...

CVE-2026-116402

The Brainstorm Force SureForms WordPress plugin (versions

CVE-2026-48202 WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8...

CVE-2026-48202

The WordPress Brave plugin (brave-popup-builder) versions up to and including 0.8.8 is vulnerable to an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability. This flaw allows for Code Injection due to insufficient sanitization of input. No specific exploit l...

WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability

Content Injection vulnerability discovered by Peter Tang in WordPress Plugin Brave versions = 0.8.8...

CVE-2026-25467

The ThemeGrill User Registration WordPress plugin (versions up to and including 5.3.0 ) is vulnerable to a Basic XSS (Cross-Site Scripting) vulnerability due to Improper Neutralization of Script-Related HTML Tags in a web page. This flaw allows for Code Injection within the user-registration comp...

CVE-2026-25467 WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0...

GHSA-9JHJ-WVMW-CFX5 i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Affected versions Verified on 4.0.2 latest on npm and on commit 07e0288 the GHSA-xvq9-wjp8-hwqf fix. Earlier 3.x/4.x versions that allow / in ns are likely affected too. Not verified on them. Impact Same class as GHSA-xvq9-wjp8-hwqf and GHSA-q89c-q3h5-w34g: when an attacker controls the namespace...

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Affected versions Verified on 4.0.2 latest on npm and on commit 07e0288 the GHSA-xvq9-wjp8-hwqf fix. Earlier 3.x/4.x versions that allow / in ns are likely affected too. Not verified on them. Impact Same class as GHSA-xvq9-wjp8-hwqf and GHSA-q89c-q3h5-w34g: when an attacker controls the namespace...

EUVD-2026-108941

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places ns right after a / bypass of the // check added for GHSA-xvq9-wjp8-hwqf...

CLEANSTART-2026-DE92020 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

Linux Distros Unpatched Vulnerability : CVE-2026-115730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting...

CVE-2026-116394

The WpEvently mage-eventpress plugin by Magepeople inc. is vulnerable to Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) . This flaw allows for Code Injection and affects versions from the earliest releases through 5.7.9 . No specific remediation or exploit details a...

CVE-2026-116394 WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection.This issue affects WpEvently: from n/a through 5.7.9...

CVE-2026-116394 WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection.This issue affects WpEvently: from n/a through 5.7.9...

WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability

Content Injection vulnerability discovered by Askar in WordPress Plugin WpEvently versions = 5.7.9...

UBUNTU-CVE-2026-115730

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load...