DRUPAL-CONTRIB-2026-161

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user...

DRUPAL-CONTRIB-2026-158

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a...

DRUPAL-CONTRIB-2026-155

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. Under certain configurations, th...

DRUPAL-CONTRIB-2026-154

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module provides JavaScript behaviours for announcing dynamic form updates to assistive technologies. In some configurations, due to improper sanitisation, specially...

WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin The Post Grid versions = 7.9.5...

WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Premium Addons for Elementor versions = 4.11.105...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.48 packages and security update

Red Hat OpenShift Container Platform release 4.19.48 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin ElementsKit Elementor addons Lite versions = 4.0.5...

WordPress Ocean Extra plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ocean Extra versions = 2.6.1...

WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Podcast Importer SecondLine versions = 1.5.6...

WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Nhat Long in WordPress Plugin Core Web Vitals & PageSpeed Booster versions = 1.0.31...

WordPress Name Directory plugin <= 1.34.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Name Directory versions = 1.34.0...

WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dcs in WordPress Plugin Mang Board WP versions = 2.4.1...

WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin wpForo Forum versions = 3.1.5...

WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Calculated Fields Form versions = 5.5.1.1...

WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin Event Tickets versions = 5.29.4...

WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WPS Limit Login versions = 1.5.9.3...

WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin PixelYourSite – Your smart PIXEL TAG Manager versions = 11.4.1...

WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dthangws in WordPress Plugin Ninja Forms versions = 3.15.3...