CVE-2026-75927: Improper Privilege Management

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...

CVE-2026-81201

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201

The Drupal Monster Menus module (versions 0.0.0 through 9.5.3 ) is vulnerable to a Stored Cross-site Scripting (XSS) issue. The root cause is the module's failure to sufficiently sanitize HTML code within the page name when it is rendered in the built-in tree browser . This allows an attacker, wh...

EUVD-2026-69997

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers ...

CVE-2026-66684 WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-66684 WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

EUVD-2026-53895

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-66684

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-66684

The CVE-2026-66684 entry concerns the WordPress plugin Export Import Menus, affected versions ≤ 1.9.2. The vulnerability is an unauthenticated sensitive data exposure in the export/import functionality. No concrete exploit details, affected files, root cause, or remediation are provided in the av...

WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Export Import Menus versions = 1.9.2...

CVE-2026-66684: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-8688: Missing Authorization

The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-56115

Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but...

CVE-2026-53693 MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels

A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS...

Cross-site Scripting (XSS)

ci4-cms-erp/ci4ms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization and output encoding of user-controlled post data in the Menu Management functionality, which allows an attacker to inject malicious scripts that execute in administrative dashboards and...