CVE-2026-89417 OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-89417 OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-105324

An HTTP header injection vulnerability exists in the start-page-loader.cgi component of ADM . This flaw allows an unauthenticated remote attacker to read arbitrary files on the host system by sending a crafted HTTP request with injected headers via the state parameter . The attacker can exploit t...

VulnCheck KEV: CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

ROS-20261007-73-0203

The vulnerability of the netopenvswitch/flownetlink.c module in the Linux operating system is related to errors in processing parameter length settings. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-89417: Improper Neutralization of Input During Web Page Generation

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-107432

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-107720

The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

Root Cause File: internal/corazawaf/transaction.go, lines 770–808 since commit 2fd87b89, PR 812, 2023-06-14 go func tx Transaction AddGetRequestArgumentkey string, value string if tx.checkArgumentLimittx.variables.argsGet tx.debugLogger.Warn.Msg"skipping get request argument, over limit" return...

GHSA-6R3Q-MJV7-XR8M Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

Root Cause File: internal/corazawaf/transaction.go, lines 770–808 since commit 2fd87b89, PR 812, 2023-06-14 go func tx Transaction AddGetRequestArgumentkey string, value string if tx.checkArgumentLimittx.variables.argsGet tx.debugLogger.Warn.Msg"skipping get request argument, over limit" return...

CVE-2026-106033

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

CVE-2026-106033 Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

CVE-2026-106033

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling in the redirect route . The application extracts a destination from the next query parameter and assigns it to location.href without proper format or scheme verification, bypas...

CVE-2026-106033 Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

CVE-2026-106033

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

CVE-2026-104070

The Crayons plugin for SPIP versions before 3.5.0 is vulnerable to a missing authorization flaw in crayons_store.php. By omitting the secu_ anti-forgery parameter, unauthenticated attackers can bypass modification checks and modify arbitrary editable object fields. This allows attackers to chain ...

NPM: Payload: Untrusted redirect URL parameter exploit

NPM: Payload: Untrusted redirect URL parameter exploit vulnerability discovered by ? in WordPress Npm payload versions = 3.40.0, 3.88.0...

Payload: Untrusted redirect URL parameter exploit

Impact Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating. Patches Users should upgrade Payload packages to = 3.88.0 or = 4.0.0-canary.27. Workarounds Upgrading is recommended. Until then, remove user-controlled...