WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the currentpageid parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain...

Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func

The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeitarticlespaginationcallback function. This is due to the function accepting user input and then passing that through calluserfunc. This makes it possible for...

WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection

WordPress TI WooCommerce Wishlist plugin before 1.40.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint. id: CVE-2022-0412 info: name: WordPress TI WooCommerce...

WordPress RevSlider - Remote Code Execution via File Upload

The ThemePunch Slider Revolution revslider plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to 1 upload and execute arbitrary files via an updateplugin...

CVE-2026-104799: rnlab Mobile builder: The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,…

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmpprofilesettings REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key allow-lis...

CVE-2026-119745: Sender: Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated…

Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the adminpostsenderdebugdownload action handled by downloadDebugFile without any capability, nonc...

PT-2026-136971

Name of the Vulnerable Software and Affected Versions Sender plugin for WordPress versions prior to 2.11.3 MultiVendorX plugin for WordPress versions prior to 5.0.21 Description A missing authorization flaw allows any authenticated user, such as those with Subscriber roles, to access a sensitive...

PT-2026-136928

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmp profile settings REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key...

PT-2026-137152

CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16 t message length counters. Attackers can send near-65535-byte data sets and large templates to a...

gradle-static-analysis-plugin

DEPRECATED Gradle static analysis plugin ⚠️ A fork of this project is maintained at https://github.com/GradleUp/static-analysis-plugin/ Please migrate by using com.gradleup.static-analysis plugin id instead. A Gradle plugin to easily apply the same setup of static analysis tools across different...

HoneyPy

HoneyPy 🍯 A low interaction honeypot with the capability to be more of a medium interaction honeypot. Project status: No longer in active development. Repository will remain for anyone wanting to use or contribute to HoneyPy. I recommend using the honeydb-agent instead:...

CVE-2026-121509

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

CVE-2026-121509 Headless CMS Plugin REST API post get_required_post_data information disclosure

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

EUVD-2026-116486

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

CVE-2026-121509

The Headless CMS Plugin (up to version 2.0.4 ) for WordPress contains an information disclosure vulnerability in the REST API component. Specifically, the get_required_post_data function within the /wp-json/rae/v1/post endpoint is susceptible to manipulation of the post_id or post_slug arguments....

CVE-2026-115715

A flaw was found in Elasticsearch. An authenticated remote user with permissions to write to or search an index utilizing the phonetic analysis plugin can cause a Denial of Service DoS by submitting specially crafted input. Processing this input results in excessive heap memory consumption, causi...

CVE-2026-121548

A flaw was found in nnn. The togglex plugin fails to properly sanitize filenames before passing them to a system command. A local attacker can exploit this flaw by placing a file with a specially crafted name in a directory, leading to arbitrary command execution with the privileges of the user...

CVE-2026-115358

A flaw was found in OpenBao. When processing requests with malformed plugin parameters, such as key-value pair or header fields, error messages containing sensitive input are recorded in audit logs. An authenticated remote attacker can exploit this issue by submitting crafted requests to trigger...

CVE-2026-106557

A flaw was found in @backstage/plugin-techdocs-node. Improper validation of TechDocs Markdown extension configurations allows an authenticated user who can register or modify documentation sources to access resources outside the intended documentation boundary during build operations. This issue...

CVE-2026-106563

A flaw was found in the Backstage Kubernetes backend plugin @backstage/plugin-kubernetes-backend. Due to improper entity validation in a deprecated services endpoint, an authenticated user with read permissions can submit crafted entity data. This issue allows unauthorized information disclosure,...