CVE-2026-91132

The open-source discussion platform Discourse contains a vulnerability in versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 . Sites utilizing wildcard patterns in the allowed_iframes setting are susceptible to a bypass where a crafted iframe URL places an allowlisted suffix after a URL...

CVE-2026-91132 Discourse: Wildcard iframe origin allowlist bypass via authority separators

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowediframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched...

CVE-2026-91132 Discourse: Wildcard iframe origin allowlist bypass via authority separators

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowediframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched...

CVE-2026-80338 CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler

The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation...

CVE-2026-80338

The CMB2 WordPress plugin before version 2.13.0 is vulnerable to a flaw where it fails to perform capability checks on one of its AJAX actions . This allows users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, potentially breaking core site setti...

CVE-2026-80338 CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler

The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation...

CVE-2026-91132: Origin Validation Error

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowediframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched...

CVE-2026-80338: Missing Authorization

The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation...

PT-2026-97706

Name of the Vulnerable Software and Affected Versions CMB2 WordPress plugin versions prior to 2.13.0 Description An issue exists where a lack of capability checks on an AJAX action allows users with Subscriber roles to create or corrupt arbitrary WordPress options. This can lead to the disruption...

PT-2026-98161

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description Sites using wildcard patterns in the allowed iframes setting may accept a crafted...

CVE-2026-4361

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the etpbsetvideooembedthumbnailresolution function using wpremoteget instead of wpsaferemoteget to fetch a remote image URL, which does not restrict requests to...

EUVD-2026-71887

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the etpbsetvideooembedthumbnailresolution function using wpremoteget instead of wpsaferemoteget to fetch a remote image URL, which does not restrict requests to...

PT-2026-86329

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the et pb set video oembed thumbnail resolution function using wp remote get instead of wp safe remote get to fetch a remote image URL, which does not restrict...

CVE-2026-18526

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

CVE-2026-18526 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

CVE-2026-18526

HumHub CE 1.18.4 and 1.18.4-pl1 have a stored XSS flaw in the oEmbed confirmation rendering workflow; the fix is tracked in GitHub PR #8373 (https://github.com/humhub/humhub/pull/8373). No exploitation evidence is provided in the documents.

CVE-2026-18526 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

EUVD-2026-62415

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

CVE-2026-18526 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

CVE-2026-18526: Improper Neutralization of Input During Web Page Generation

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...