WordPress ProSolution WP Client plugin < 2.0.11 - Reflected XSS via 'page' Parameter vulnerability

Reflected XSS via 'page' Parameter vulnerability discovered by Erwan LR WPScan in WordPress Plugin ProSolution WP Client versions 2.0.11...

WordPress Content Views plugin < 4.5 - Subscriber+ SQL Injection via preview_request vulnerability

Subscriber+ SQL Injection via previewrequest vulnerability discovered by Jakub Herman in WordPress Plugin Content Views versions 4.5...

CVE-2026-81733

WWBN AVideo through 30.0 and master up to commit 4cb576e contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $REQUEST via a GET...

CVE-2026-5510

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

CVE-2026-6128

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...

libxml2 security update

An update is available for libxml2. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libxml2 library is a development toolbox providing the implementation of...

RLSA-2026:60394 Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow CVE-2026-11979 For more details about the security issues, including the impact, a CVSS score,...

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Security researcher Olivier Laflamme has disclosed two independent root remote code execution RCE chains affecting the Unitree G1 EDU , including a Bluetooth Low Energy BLE path that can reach root on the robot's Locomotion PC. The flaws are tracked asCVE-2026-76639 and CVE-2026-76640 , with the...

CVE-2026-9018

CVE-2026-9018 CVE-2026-9018 — Easy Elements for Elementor ≤ 1.4.5 | Escalação de Privilégios sem Autenticação Pesquisa por: Atomic Edge Severidade: Alta | CVSS: 8.8 | Autenticação necessária: Nenhuma Visão Geral Existe uma vulnerabilidade de escalação de privilégios sem autenticação no plugin...

CVE-2026-31431

CVE-2026-31431 "Copy Fail" - Strumento di Ricerca e Pentesting ⚠️ DICHIARAZIONE DI NON RESPONSABILITÀ Questo progetto è fornito esclusivamente per: Ricerca sulla sicurezza Scopi educativi Test di penetrazione autorizzati Ambienti CTF e di laboratorio Utilizzando questo strumento, dichiari che:...

CVE-2026-6176

The Customer Reviews for WooCommerce WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 5.106.0 . The root cause is insufficient input sanitization and output escaping: review comment text submitted via the cr_local_forms_submit AJAX acti...

EUVD-2026-67711

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...

CVE-2026-6176 Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...

CVE-2026-6176 Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...

CVE-2026-3423 Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-67709

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocketbeacon AJAX endpoint. This makes it possible for unauthenticated...

CVE-2026-5934 WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocketbeacon AJAX endpoint. This makes it possible for unauthenticated...

EUVD-2026-67708

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-3423 Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-5934 WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocketbeacon AJAX endpoint. This makes it possible for unauthenticated...