WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting

WordPress MW Font Changer plugin 4.2.5 and before contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ntbhwswitchtec: Fixed an out-of-bounds situation in switchtecntbmwsettrans. There is a kernel API called ntbmwcleartrans, which passes 0 to both addr and size. This would cause xlatepos to become negative. 23.734156 switchtec...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/arm/malidp: fixed a possible null pointer dereferencing issue. In malidpmwconnectorreset, new memory is allocated using kzalloc, but no checks are performed. To prevent null pointer dereferencings, ensure that mwstate is...

CVE-2026-78363

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...

EUVD-2026-68991

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...

WordPress MW WP Form plugin < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin MW WP Form versions 5.1.5...

CVE-2026-78363

The MW WP Form WordPress plugin versions before 5.1.5 fail to sanitize shortcodes in user-submitted values before merging them into a completion message that is later processed for shortcodes. This allows unauthenticated users to execute any shortcode registered on the site by submitting crafted ...

CVE-2026-78363 MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...

CVE-2026-78363 MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...

PT-2026-84124

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...

CVE-2026-78364

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

CVE-2026-78364 MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

EUVD-2026-68158

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

CVE-2026-78364

The MW WP Form WordPress plugin, in versions prior to 5.1.6 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitise and escape certain form settings before they are rendered on an admin dashboard page. This flaw allows users with privileges as low as Edito...

WordPress MW WP Form plugin < 5.1.6 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin MW WP Form versions 5.1.6...

CVE-2026-78364 MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

PT-2026-83526

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ntb: ntbhwswitchtec: Fixed array-index-out-of-bounds access The number of MW LUTs depends on the NTB configuration and can be set to MAXMWS. This patch prevents invalid index out-of-bounds access to mwsizes. When an invalid acces...

MAL-2026-14087 Malicious code in mw-filesystem-events-nodream-es6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e79317db717bd6c38646bef40f0e5205e0f42a3174319f95d9b5e7153cc8fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the data-mw-iframeconfig attribute when handling malformed URLs or IDs containing single quotes. An attacker can execute arbitrary JavaScript in the context of the affected site by injecting malicious payloa...