CVE-2026-8853

The CVE-2026-8853 entry concerns the WordPress plugin MW WP Form (versions up to and including 5.1.3) with a Stored Cross-Site Scripting vulnerability via the memo parameter. The root cause is insufficient input sanitization and output escaping, enabling authenticated attackers with editor-level ...

com.github.paulcwarren:content-rest-spring-boot-starter (>=0.0.9, <=0.0.11), com.github.paulcwarren:spring-content-rest (>=0.0.9, <=0.0.11) +7 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.10.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.paulcwarren:content-rest-spring-boot-starter...

com.github.paulcwarren:content-rest-spring-boot-starter (>=0.0.9, <=0.0.11), com.github.paulcwarren:spring-content-rest (>=0.0.9, <=0.0.11) +7 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.10.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.paulcwarren:content-rest-spring-boot-starter...

PT-2026-48554

Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice...

PT-2026-48393

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'memo' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above,...

CVE-2026-53740: Improper Neutralization of Input During Web Page Generation

Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice...

CVE-2026-8853: Improper Neutralization of Input During Web Page Generation

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'memo' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above,...

WordPress plugin Yoast Duplicate Post has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

WordPress MW WP Form plugin <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability

Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by Sérgio Charruadas itzvenom in WordPress Plugin MW WP Form versions = 5.1.3...

tshistory-editor (0.8.2), tshistory-refinery (>=0.1.0, <=0.5.0) +1 more potentially affected by CVE-2024-21485 via dash-core-components (1.10.1)

dash-core-components PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - tshistory-editor 0.8.2 - tshistory-refinery =0.1.0, =0.11.1, =0.15.1 Source cves: CVE-2024-21485 Source advisory:...

tshistory-editor (>=0.2.0, <=0.4.0), tsview (>=0.2.0, <=0.2.1) potentially affected by CVE-2024-21485 via dash-core-components (0.22.1)

dash-core-components PYPI version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - tshistory-editor =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-219...

tshistory-editor (>=0.5.0, <=0.8.1), tsview (>=0.6.0, <=0.11.0) potentially affected by CVE-2024-21485 via dash-core-components (1.0.0)

dash-core-components PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - tshistory-editor =0.5.0, =0.6.0, =0.11.0 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-219...

tshistory-editor (>=0.2.0, <=0.4.0), tsview (>=0.2.0, <=0.2.1) potentially affected by CVE-2024-21485 via dash-html-components (0.10.0)

dash-html-components PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - tshistory-editor =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

dragg (0.0.0), dragg-gym (0.0.1) +6 more potentially affected by CVE-2024-21485 via dash-html-components (1.0.3)

dash-html-components PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - dragg 0.0.0 - dragg-gym 0.0.1 - simba-uw-no-tf =1.2.9.2, =0.70.0, =0.10.0, =0.1.0, =0.11.1, =0.15.1 Source cves:...

@burger-editor/client (>=4.0.0-alpha.62, <=4.0.0-alpha.70), @children-of-atom/reactive-api (0.3.0) +23 more potentially affected by CVE-2026-42567 via svelte (>=5.51.5, <=5.55.5)

svelte NPM version =5.51.5, =4.0.0-alpha.62, =0.0.15, =8.1.10, =6.1.0, =0.1.0, =2.6.0, =6.4.1, =6.4.1, =4.0.0-alpha.4, =5.0.0-rc.0, =5.0.0-rc.0, =4.18.0, =1.26.10, =1.0.0-dev.35, =1.0.0-dev.56 and more Source cves: CVE-2026-42567 Source advisory: MEND:CVE-2026-42567...

WordPress Booking Package plugin <= 1.7.16 - Authenticated (Editor+) Privilege Escalation vulnerability

Authenticated Editor+ Privilege Escalation vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin Booking Package versions = 1.7.16...

CVE-2026-11621

A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /admin/dcat-api/editor-md/upload of the component User Setting Page. This manipulation of the argument editormd-image-file causes unrestricted upload. The attack can be initiated...

CVE-2026-11621

A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /admin/dcat-api/editor-md/upload of the component User Setting Page. This manipulation of the argument editormd-image-file causes unrestricted upload. The attack can be initiated...

CVE-2026-11621 Dcat-Admin User Setting upload editorMDUpload unrestricted upload

A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /admin/dcat-api/editor-md/upload of the component User Setting Page. This manipulation of the argument editormd-image-file causes unrestricted upload. The attack can be initiated...

dcat-admin Access Control Vulnerability

dcat-admin is a backend system building tool based on Laravel, developed by Jiang Qinghua. Versions of Dcat-Admin 2.2.3-beta and earlier contain an access control vulnerability. This vulnerability stems from the editorMDUpload function in /admin/dcat-api/editor-md/upload, which allows unlimited...