CVE-2026-79621 CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

WordPress Rank Math SEO plugin < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure vulnerability

Unauthenticated Non-Public Post Schema and Content Disclosure vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Non-Public Post Content Disclosure vulnerability

Author+ Non-Public Post Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Rank Math SEO versions 1.0.277...

EUVD-2026-69840

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

WordPress Rank Math SEO plugin < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure vulnerability

Unauthenticated Password-Protected Post Content Disclosure vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277.1...

CVE-2026-16966 Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content

The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...

CVE-2026-16966 Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content

The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...

EUVD-2026-69867

The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...

CVE-2026-16966

The Solace Extra WordPress plugin (versions before 1.7.0 ) is vulnerable to unauthenticated content disclosure. The flaw exists because one of its AJAX actions fails to perform proper authorization or post-status checks . This allows unauthenticated visitors to access and read content from non-pu...

WordPress Solace Extra plugin < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure vulnerability

Unauthenticated Draft/Private Site Builder Content Disclosure vulnerability discovered by JunHee CHO in WordPress Plugin Solace Extra versions 1.7.0...

Security Bulletin: Vulnerability in AngularJS affects IBM License Key Server Administration and Reporting Tool

Summary Potential vulnerability in AngularJS has been identified that affects IBM License Key Server Administration and Reporting Tool. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2025-0716 DESCRIPTION: Improper sanitization ...

CVE-2026-3851

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: 1 the save-time sanitization filter etbuildersanitizedynamiccontentfields only searche...

CVE-2026-3851 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: 1 the save-time sanitization filter etbuildersanitizedynamiccontentfields only searche...

CVE-2026-3851 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: 1 the save-time sanitization filter etbuildersanitizedynamiccontentfields only searche...

CVE-2026-3851

The Divi theme for WordPress (versions up to 4.27.6 ) is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format. Two compounding flaws enable the attack: the save-time sanitization filter et_builder_sanitize_dynamic_content_fields() only checks for the @ET-...

EUVD-2026-69830

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: 1 the save-time sanitization filter etbuildersanitizedynamiccontentfields only searche...

CVE-2026-84695

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

CVE-2026-84695 BookStack before 26.05.4 Stored XSS via Drawing Upload

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

EUVD-2026-69786

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

PT-2026-84596

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: 1 the save-time sanitization filter et builder sanitize dynamic content fields only...