EUVD-2026-72392

league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its numeric-suffix search from 1 on every slug collision, resulting in OK^2 time complexity for K headings that collapse to the same base slug...

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

CVE: This vulnerability corresponds to CVE-2026-68584. Summary SiYuan's publish mode defines a "protected" access level: a document that is publicly listed but requires a password to read per the product's own UI help text, protected = "Publicly visible, requires password to access". The password...

EUVD-2026-52275

SiYuan: Full-content disclosure of publish-disabled documents via getHeadingTransaction endpoints publish mode: reader-reachable rendered DOM with no publish-access check...

GHSA-69MH-GVH4-8GP7 SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

CVE: This vulnerability corresponds to CVE-2026-68587. Summary Three "heading transaction" endpoints /api/block/getHeadingDeleteTransaction, /api/block/getHeadingLevelTransaction, and /api/block/getHeadingInsertTransaction return the rendered block DOM of a heading and its subtree in the computed...

CVE-2026-75980

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-75980 BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-75980

CVE-2026-75980 is a Stored Cross-Site Scripting (XSS) vulnerability in the BetterDocs WordPress plugin (versions ≤ 4.8.1), discovered by Wordfence PRISM . The flaw resides in the Heading 'id' attribute within post content: entity-encoded quotes bypass wp_kses_post at save time, and the payload ma...

EUVD-2026-68986

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

WordPress BetterDocs plugin <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin BetterDocs versions = 4.8.1...

CVE-2026-68587

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can...

CVE-2026-68584

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

CVE-2026-68587

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can...

CVE-2026-68587 SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can...

CVE-2026-68587

SiYuan has a information-disclosure vulnerability affecting versions before v3.7.3. The flaw lies in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints, which return rendered block DOM without publish-access checks. Consequently, anonymous reade...

CVE-2026-68584

CVE-2026-68584 affects SiYuan before v3.7.3. An authentication bypass exists in publish mode: content endpoints that return headings or backlinks (getHeadingChildrenDOM, getHeading*Transaction, getBacklinkDoc) do not enforce the password check, even though the main getDoc endpoint is protected. A...

EUVD-2026-52272

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

PT-2026-67404

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description An information disclosure issue exists where the endpoints 'getHeadingDeleteTransaction', 'getHeadingLevelTransaction', and 'getHeadingInsertTransaction' return rendered block DOM without performing...

CVE-2026-16090

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in 'gamipressachievement' in all versions up to, and including, 7.9.9.1 due to insufficient input...

CVE-2026-16090

The CVE affects the WordPress plugin GamiPress (Gamification) up to version 7.9.9.1. It describes a Stored Cross-Site Scripting vulnerability via the heading_size attribute of the gamipress_achievement shortcode. The root cause is insufficient input sanitization and output escaping, with the payl...

EUVD-2026-51750

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in 'gamipressachievement' in all versions up to, and including, 7.9.9.1 due to insufficient input...