EUVD-2026-91209

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

WordPress WP User Frontend plugin < 4.3.12 - Subscriber+ Post Creation vulnerability

Subscriber+ Post Creation vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP User Frontend versions 4.3.12...

PT-2026-104461

Name of the Vulnerable Software and Affected Versions Shopclass versions prior to 6.2.0 Description A stored cross-site scripting issue exists when the frontend TinyMCE is enabled. This allows self-registered non-admin users to inject malicious JavaScript into item listing descriptions. The...

CVE-2026-79618: Missing Authorization

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

PT-2026-104108

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

Important: Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image

A new satellite/iop-vulnerability-frontend-rhel9 container image is now available as a technical preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed package...

Important: Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image

A new satellite/iop-vulnerability-frontend-rhel9 container image is now available as a technical preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed package...

Moderate: Red Hat Security Advisory: General availability of the satellite/iop-advisor-frontend-rhel9 container image

A new satellite/iop-advisor-frontend-rhel9 container image is now generally available in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services...

autoreduce-frontend (>=22.0.0.dev22, <=22.0.0.dev23), django-rq-scheduler (2022.5.1) +4 more potentially affected by CVE-2026-15307 via django (4.0.4)

django PYPI version 4.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-frontend =22.0.0.dev22, =0.0.17, =0.7.15, =0.7.23 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

autoreduce-db (22.0.0.dev37), autoreduce-frontend (22.0.0.dev24) +6 more potentially affected by CVE-2026-15307 via django (4.0.6)

django PYPI version 4.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-db 22.0.0.dev37 - autoreduce-frontend 22.0.0.dev24 - autoreduce-qp 22.0.0.dev38 - autoreduce-rest-api 22.0.0.dev23 - autoreduce-scripts...

autoreduce-db (>=0.1.0, <=22.0.0.dev1), autoreduce-frontend (>=21.1.1, <=21.1.3) +4 more potentially affected by CVE-2026-15307 via django (3.2.2)

django PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-db =0.1.0, =21.1.1, =21.1.0, =22.0.0.dev0, =21.1.2, =21.1.4 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

WordPress DevKit Pro plugin <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow vulnerability

Unauthenticated Authentication Bypass to Administrator Account Takeover via 'originaluserid' Cookie in Frontend Revert Switch Flow vulnerability discovered by h0xilo in WordPress Plugin DevKit Pro versions = 2.3.0...

WordPress User Frontend plugin 3.5.29-4.3.11 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Murad Akhmedov in WordPress Plugin WP User Frontend versions 3.5.29-4.3.11...

Rocky Linux 10.0 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2025_7892)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257892 advisory. grafana: Cross-site Scripting XSS in Grafana via Custom Frontend Plugins and Open Redirect CVE-2025-4123 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2025_7894)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257894 advisory. grafana: Cross-site Scripting XSS in Grafana via Custom Frontend Plugins and Open Redirect CVE-2025-4123 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2025_7893)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257893 advisory. grafana: Cross-site Scripting XSS in Grafana via Custom Frontend Plugins and Open Redirect CVE-2025-4123 grafana: Cross-site Scripting XSS in Grafana via Custom...

Malicious Package

Overview epic-web-purchase-frontend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

WordPress User Frontend plugin 2.5.8-4.3.11 - Unauthenticated Account Creation with Registration Disabled vulnerability

Unauthenticated Account Creation with Registration Disabled vulnerability discovered by Murad Akhmedov in WordPress Plugin WP User Frontend versions 2.5.8-4.3.11...

WordPress Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms plugin <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Frontend Post Submission Manager Lite versions = 1.3.4...