CVE-2026-7105 Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function

The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the getmenucontenteditor function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

PT-2026-68039

Name of the Vulnerable Software and Affected Versions Xpro Addons versions prior to 1.5.2 Description The Xpro Addons plugin for WordPress contains a flaw allowing unauthorized data creation due to a missing capability check in the get menu content editor function. Authenticated users with...

CVE-2020-18065

Cross Site Scripting XSS vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu...

Cross-site Scripting (XSS)

typo3/cms-backend is vulnerable to cross-site scripting. An authenticated malicious user is able to inject and execute malicious script via the content elements of type menu when their referenced items get previewed in the page module...

PT-2021-14453 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 7.6.51 TYPO3 versions prior to 8.7.40 TYPO3 versions prior to 9.5.25 TYPO3 versions prior to 10.4.14 TYPO3 versions prior to 11.1.1 Description: The issue concerns content elements of type menu being vulnerable to...