CVE-2026-10166

creationtimestamp| type| source ---|---|--- 2026-05-31 05:28:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn4tfvuvxl26...

CVE-2026-49361

creationtimestamp| type| source ---|---|--- 2026-05-30 17:42:38+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mn3lyg4rz32y...

CVE-2018-25426

creationtimestamp| type| source ---|---|--- 2026-05-30 17:04:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn3jtu7lya2q...

CVE-2014-3508

creationtimestamp| type| source ---|---|--- 2026-05-30 16:29:34+00:00| seen| https://gist.github.com/xadenryan/c9b467b0ab31ac5f421303705973d5d8...

CVE-2026-7459

The Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress is vulnerable to authenticated Subscriber+ account takeover in all versions up to, and including, 5.26.0 via the event reaction endpoints reacttoevent / unreacttoevent. The endpoints register getitemspermissionschec...

CVE-2026-7459 Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint

The Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress is vulnerable to authenticated Subscriber+ account takeover in all versions up to, and including, 5.26.0 via the event reaction endpoints reacttoevent / unreacttoevent. The endpoints register getitemspermissionschec...

EUVD-2026-33455

The Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress is vulnerable to authenticated Subscriber+ account takeover in all versions up to, and including, 5.26.0 via the event reaction endpoints reacttoevent / unreacttoevent. The endpoints register getitemspermissionschec...

CVE-2026-7459

The Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress is vulnerable to authenticated Subscriber+ account takeover in all versions up to, and including, 5.26.0 via the event reaction endpoints reacttoevent / unreacttoevent. The endpoints register getitemspermissionschec...

CVE-2026-7459 Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint

The Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress is vulnerable to authenticated Subscriber+ account takeover in all versions up to, and including, 5.26.0 via the event reaction endpoints reacttoevent / unreacttoevent. The endpoints register getitemspermissionschec...

CVE-2026-7459

The CVE concerns the Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress (

WordPress plugin Simple History 授权问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-45088

Name of the Vulnerable Software and Affected Versions Simple History versions prior to 5.26.1 Description The Simple History plugin for WordPress allows authenticated users with Subscriber-level permissions or higher to take over accounts. The issue exists in the event reaction endpoints...

CVE-2026-47266

creationtimestamp| type| source ---|---|--- 2026-05-29 22:08:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmzkfldrxk25...

CVE-2026-45151

creationtimestamp| type| source ---|---|--- 2026-05-29 21:44:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmzj2gvkuo2d...

CVE-2026-44420

creationtimestamp| type| source ---|---|--- 2026-05-29 21:01:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmzgnhigoh2v 2026-05-30 13:56:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116663869287019686...

HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint

Summary HaxCMS is affected by a stored cross-site scripting XSS vulnerability in the /system/api/saveNode endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. For example...

CVE-2026-48527

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting XSS vulnerability in the /system/api/saveNode endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by...

CVE-2025-41272

creationtimestamp| type| source ---|---|--- 2026-05-29 13:00:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmylqp4ykq2t 2026-06-22 07:01:35+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3moucvbux762v...

CVE-2025-41267

creationtimestamp| type| source ---|---|--- 2026-05-29 12:58:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmylnj34qv2e...

CVE-2026-48527

HAX CMS (PHP/NodeJS backends) is affected up to version 26.0.0 by a stored XSS in the /system/api/saveNode endpoint. An authenticated user with page-edit permissions can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. Affected compon...