Fedora 45 : GitPython / python-mkdocs-rss-plugin (2026-3fa772c573)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-3fa772c573 advisory. Update to 3.2.1 Fixes GHSA-gq48-pqfc-9p58, GHSA-23mf-xhv8-69c2, GHSA-f9j4-qggq-h239, GHSA-w8jc-g24h-crhw, GHSA-m64x-33q8-m5h7, GHSA-fx3j-rwgx-fr94, and...

Fedora 45 : gnome-shell-extension-gsconnect (2026-508badc038)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-508badc038 advisory. Voici les notes de la release, telles que publies par daniellandau le 2026-09-23 : --- Release GSConnect v73 What's Changed Security: fix authenticated path...

CVE-2026-103882: acadlix: The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to…

The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postdeleteassessmentfilebyid function in all versions up to, and including, 1.1.9. This makes it possible for...

PT-2026-134482

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar – Amelia plugin for WordPress versions prior to 2.4.13 Description Unauthenticated attackers can extract personally identifiable information of staff members, including full names, email addresses,...

PT-2026-134432

Name of the Vulnerable Software and Affected Versions Mapster WP Maps WordPress plugin versions prior to 2.0.6 Description An authorization bypass exists in a REST API route used for writing post data. This allows unauthenticated attackers to overwrite the titles of arbitrary posts, create new...

CVE-2026-118437: Unknown BuddyForms: The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded…

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors...

CVE-2025-11455: tigroumeow: The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability…

The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access an...

CVE-2026-116535: rainbowgeek SEOPress – AI SEO Plugin & On-site SEO: The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-116752: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to…

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postimages' parameter in all versions up to, and including, 2.8.197 due to insufficient input sanitization and output escaping. This makes i...

PT-2026-134476

Name of the Vulnerable Software and Affected Versions SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress versions prior to 10.4 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Sit...

CVE-2026-118638: Unknown Mapster WP Maps: The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that…

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...

PT-2026-134483

Name of the Vulnerable Software and Affected Versions All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights versions prior to 5.0.4 Description An issue exists that allows unauthenticated attackers to extract arbitrary non-public post meta values...

CVE-2026-107765: marketingfire Discussion Board – WordPress Forum Plugin: The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in…

The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 via the user profile Website userurl field. This is due to insufficient output escaping in the ctdbfiltercommentauthorname callback hooked to...

CVE-2026-118043: Unknown Bulk Media Register: The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a…

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls an...

Apache Struts2 Spring Plugin Class Reloading Denial of Service

Apache Struts2 Spring Plugin contains a class-reloading initialization error that closes the Spring application context before it is subsequently used, causing startup to abort when the documented developer-mode reload configuration is enabled...

CVE-2026-118184: Unknown Premium Packages: The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the…

The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing...

PT-2026-134428

The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account...

CVE-2024-10629

🛠️ GPX Viewer Exploit CVE-2024-10629 This repository contains a proof-of-concept exploit for the GPX Viewer plugin for WordPress, which is vulnerable to arbitrary file creation CVE-2024-10629. The vulnerability allows authenticated attackers with subscriber-level access and above to create...

CVE-2024-27956

CVE-2024-27956 Note Build wordpress: docker-compose -f stack.yml up Install plugin: 1. WordPress dashboard, choose Plugins Add New 2. Click Upload Plugin 3. Choose File - wp-automatic.zip - Install Now 4. After the installation is complete, click Activate Plugin Exploit...

CVE-2023-26255-6

Jira plugin STAGIL Navigation FileName Parameter Arbitrary File Read Vulnerability POC Script Usage as follows: Single URL Detection 1. Use the command line to detect a single URL, pass the URL parameter with -U 2. Observe the returned result; if it shows "is vulnerable!", then the vulnerability...