CVE-2026-81289

CVE-2026-81289 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin, affecting versions 5.13.1 and earlier . The vulnerability requires user interaction (victim must visit a crafted page) but needs no prior au...

CVE-2026-81288

CVE-2026-81288 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the Upsell Order Bump Offer for WooCommerce WordPress plugin, affecting versions 3.1.5 and below . The CVSS v3.1 score is 7.1 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L , indicating a network-based attack...

EUVD-2026-69921

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.4 versions...

CVE-2026-84781 WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.4 versions...

CVE-2026-84781 WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.4 versions...

WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HieuPenguinnn in WordPress Theme Graphene versions = 2.9.4...

WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by momopon1415 in WordPress Plugin RTMKit versions = 2.1.5...

PYSEC-2026-3966

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.This CVE is marked as...

CVE-2026-32773

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as...

PYSEC-2026-3966

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as...

WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by TwinSecKR in WordPress Plugin WP Statistics versions = 14.16.11...

WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jiemook in WordPress Plugin Breadcrumb NavXT versions = 7.5.1...

WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by bekitousei in WordPress Plugin EWWW Image Optimizer versions = 8.7.6...

CVE-2026-32773

The org.apache.spark:spark-core_2.12 component is vulnerable to Cross-site Scripting (XSS) in versions prior to 3.5.8 . The root cause is a lack of XSS escaping in the Spark History Server , specifically within the application-name rendering at core/src/main/resources/org/apache/spark/ui/static/h...

CVE-2026-32773 Apache Spark: XSS Vulnerability in Spark Web 3.5.4

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as...

CVE-2026-32773 Apache Spark: XSS Vulnerability in Spark Web 3.5.4

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as...

WordPress Estatik plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Neelakandan A in WordPress Plugin Estatik versions = 4.3.5...

WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Gallery PhotoBlocks versions = 1.3.4...

WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin TrustedSite versions = 1.2.5...

Important: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...