npm: obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

npm: obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields vulnerability discovered by ? in WordPress npm obsidian-tc versions 1.3.1...

A-potential-Denial-of-Service-issue-in-protobuf-java

A-potential-Denial-of-Service-issue-in-protobuf-java A potential Denial of Service issue in protobuf-java high severity GitHub Reviewed Published 5 days ago in protocolbuffers/protobuf • Updated yesterday Vulnerability details Dependabot alerts 2 Package com.google.protobuf:protobuf-java maven...

CVE-2026-94263

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed...

CVE-2021-39476

CVE-2021-39476 Found multiple XSS vulnerabilities within PhoenixCart 1.0.8.0 2x XSS on the same page "Edit the Category Title for SEO:" "Edit the Category Description" Link: https://www.warcloudsecurity.com/ecommerce/index.php?cPath=1...

CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation

Cmsmadesimple CMS Reflected XSS v2.2.18 Author: Sergio Description: Multiple Cross-Site Scripting XSS vulnerabilities in installation of cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the Database Name, DataBase User or Database...

CVE-2026-94263

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins (versions 0.9.2.4 through 0.9.2.7 ) are vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the inconsistent failure to disable shortcode processing within the confirmation ...

CVE-2026-94263 Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed...

EUVD-2026-108668

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed...

CVE-2023-43877-RiteCMS-Stored-XSS---Home

Rite CMS v3.0 Multiple Stored XSS Author: Sergio Description: Rite CMS 3.0 is affected by a Multiple Cross-Site scripting XSS stored vulnerability that allows attackers to execute arbitrary code via a payload crafted in the Home Page fields in the Administration menu. The payload will be executed...

WordPress Advanced Custom Fields: Extended PRO plugin 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover vulnerability

Unauthenticated Non-Administrator Account Takeover vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Advanced Custom Fields: Extended PRO versions 0.9.2.7...

WordPress Advanced Custom Fields: Extended plugin 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover vulnerability

Unauthenticated Non-Administrator Account Takeover vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin ACF Extended versions 0.9.2.7...

WordPress Advanced Custom Fields: Extended PRO plugin 0.9.2.7 - Unauthenticated Administrator Account Takeover vulnerability

Unauthenticated Administrator Account Takeover vulnerability discovered by Jakub Herman in WordPress Plugin Advanced Custom Fields: Extended PRO versions 0.9.2.7...

WordPress Advanced Custom Fields: Extended PRO plugin < 0.9.2.8 - Unauthenticated RCE vulnerability

Unauthenticated RCE vulnerability discovered by Jakub Herman in WordPress Plugin Advanced Custom Fields: Extended PRO versions 0.9.2.8...

WordPress Advanced Custom Fields: Extended plugin < 0.9.2.8 - Unauthenticated RCE vulnerability

Unauthenticated RCE vulnerability discovered by Jakub Herman in WordPress Plugin ACF Extended versions 0.9.2.8...

WordPress Advanced Custom Fields: Extended plugin 0.9.2.7 - Unauthenticated Administrator Account Takeover vulnerability

Unauthenticated Administrator Account Takeover vulnerability discovered by Jakub Herman in WordPress Plugin ACF Extended versions 0.9.2.7...

ExtendIntel

ExtendIntel This package extends the Intel package to log more fields If the intel file contains the following fields, the data will automatically be added to the intel.log. threatscore verdict verdictsource confidence desc lastseen firstseen url reports campaigns associated category...

CVE-2026-94264

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output...

CVE-2026-94262

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that...

CVE-2026-94268

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage...

CVE-2026-94267

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...