WordPress SEO Booster plugin <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback() vulnerability

Authenticated Subscriber+ Missing Authorization to Arbitrary Options Modification via handleoauthcallback vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin SEO Booster versions = 7.4.7...

WordPress PuppyFW plugin <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation vulnerability

Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin PuppyFW versions = 0.4.4...

CVE-2026-92561

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2026-92561 Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

EUVD-2026-82734

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2026-92561

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'options' parameter in all versions up to and including 11.8.2 . The root cause is insufficient input sanitization and output escaping in the timeline v2 component (wpbc-class-timeline_v2.php)....

CVE-2026-92561 Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

PT-2026-95277

Name of the Vulnerable Software and Affected Versions Booking Calendar versions prior to 11.8.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting XSS, a technique where malicious scripts are injected into a we...

CVE-2026-92561: Improper Neutralization of Input During Web Page Generation

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

PT-2026-95272

Name of the Vulnerable Software and Affected Versions Filter Gallery versions prior to 1.1.5 Description The plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with subscriber-level access or higher to overwrite the title and...

CVE-2026-90978: Improper Access Control

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin...

CVE-2026-89138: Missing Authorization

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

EulerOS Virtualization 2.12.0 : dracut (EulerOS-SA-2026-3636)

According to the versions of the dracut packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted...

PT-2026-95278

The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the wpbc ajax option save AJAX action. The vulnerability exists because the handle ajax save function applies per-option safeguards only to names explicitly registered...

EulerOS 2.0 SP15 : dracut (EulerOS-SA-2026-3777)

According to the versions of the dracut packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic...

CVE-2026-88904 PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...

CVE-2026-88904

The PuppyFW WordPress plugin (versions

CVE-2026-88904 PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109819)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109819 advisory. The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading...

EulerOS 2.0 SP15 : dracut (EulerOS-SA-2026-3802)

According to the versions of the dracut packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic...