CVE-2026-64628

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...

CVE-2026-64628

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...

CVE-2026-64628 Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...

CVE-2026-64628 Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...

CVE-2026-64628

Grav (CVE-2026-64628) suffers a stored XSS in shortcode-core attribute handlers. The XSS bypasses validation because the detector only flags payloads with literal angle brackets, allowing shortcode parameters to inject JavaScript that runs in any viewer’s browser, including admins. Attackers with...

CVE-2026-14185

The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration...

CVE-2026-13439

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

CVE-2026-14185 WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update

The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration...

CVE-2026-14185 WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update

The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration...

CVE-2026-14185

The WPBot WordPress plugin versions prior to 8.2.0 is vulnerable to a configuration modification flaw. The root cause is a missing capability or nonce check within one of its retrieval-augmented-generation (RAG) settings handlers. This security oversight allows authenticated users with subscriber...

CVE-2026-14185

The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration...

CVE-2026-13439

The CVE-2026-13439 entry affects the WordPress plugin Easy Form Builder by WhiteStudio up to version 4.0.11 , where the password-recovery flow relies on a publicly visible session identifier ('sid') as the reset token stored in wp_emsfb_temp_links, combined with a publicly accessible nonce refres...

CVE-2026-13439 Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

EUVD-2026-46156

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

CVE-2026-13439 Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

Exploit for CVE-2026-13156

CVE-2026-13156 — MailerSend Official SMTP Integration About...

📄 WordPress LearnPress 4.3.2.8 Unauthenticated Quiz Answer Deletion

WordPress LearnPress plugin version 4.3.2.8 contains an unauthenticated quiz answer deletion vulnerability through a broken access control. A remote attacker can delete quiz answers without authorization. This proof of concept exploit demonstrates the vulnerable request flow against the affected...

CVE-2026-13439: Improper Privilege Management

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

PT-2026-61838

The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration...

📄 WordPress WP User Frontend 4.2.4 Unauthenticated Arbitrary Attachment/File Deletion

WordPress WP User Frontend plugin version 4.2.4 contains an unauthenticated arbitrary attachment/file deletion vulnerability. A remote attacker can delete arbitrary files accessible to the affected WordPress installation. This proof of concept exploit demonstrates the vulnerable request flow...