CVE-2026-9696

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.3.58 . The root cause is insufficient input sanitization and output escaping involving the 'not_found' parameter within the wPDM_packages shortcode . An authenticated...

EUVD-2026-96067

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notfound' parameter in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2026-76573 Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress Pods plugin <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'notfound' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Pods versions = 3.3.9.1...

CVE-2026-76573: Improper Neutralization of Input During Web Page Generation

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2018-2896

Malware in sbrugna...

CVE-2020-14016: Weak Password Recovery Mechanism for Forgotten Password

An issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to reset their passwords by using either their username or the email address associated with their account. However, the feature returns a notfound message when the provided username or email address does...