CVE-2026-114444 Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

EUVD-2026-113744

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

EUVD-2026-113724

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

CVE-2026-114444

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin (versions before 2.191 ) contains a vulnerability where the File System Watcher file viewer lacks proper access controls. Specifically, it does not restrict the viewer to Super Admins or only the files it legitimat...

CVE-2025-10046

CVE-2025-10046 - ELEX WooCommerce Google Shopping Author: Byte Reaper Description CVE-2025-10046 is a SQL injection vulnerability in the ELEX WooCommerce Google Shopping Product Feed plugin for WordPress, versions 1.4.3 and earlier. The issue resides in the includes/elex-manage-feed-ajax.php file...

learning-management-system

learning-management-system Masteriyo - LMS for WordPress = 1.6.7 - Sensitive Information Exposure Plugin Info Software Type Plugin Software Slug learning-management-system view on wordpress.org Patched? Yes Remediation Update to version 1.6.8, or a newer patched version Affected Version 1.6.8...

oni-framework

Oni-Framework Oni framework is a platform for embedded device software development. It is used in order to remotely debug/add functionality to an embedded device. As of right now, the main concepts are a fully modular plugin system, with local and remote rpc. This was designed to run at ring-0...

CVE-2026-3584

CVE-2026-3584 – WordPress Kali Forms = 2.4.9 - Unauthenticated Remote Code Execution via formprocess 🔥 Vulnerability Summary The WordPress Kali Forms plugin versions = 2.4.9 contain a critical unauthenticated remote code execution RCE vulnerability. This flaw allows unauthenticated attackers to...

Lime-RAT

Outdated. Archive it instead of delete it LimeRAT v0.1.9 Remote Administration Tool For Windows Description Simple yet powerful RAT for Windows machines. This project is simple and easy to understand, It should give you a general knowledge about dotNET malwares and how it behaves. Main Features...

PT-2026-134440

Name of the Vulnerable Software and Affected Versions Discussion Board – WordPress Forum Plugin versions prior to 2.6.1 Description Stored Cross-Site Scripting occurs via the user profile Website user url field. The issue stems from insufficient output escaping in the ctdb filter comment author...

PT-2026-133284

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

PT-2026-133620

Name of the Vulnerable Software and Affected Versions Scribus versions prior to 1.6.7 Scribus versions 1.7.x prior to 1.7.4 Description The importdrw Micrografx Draw plugin contains an out-of-bounds write issue. This occurs because the plugin uses an unvalidated y offset to select image scanlines...

PT-2026-133285

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

PT-2026-133648

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc search results in src/my-calendar-search.php without bracket encoding before ...

CVE-2026-115820: ahmadmj Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin: The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to…

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'columns array keys' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-119554: Moodle Project moodle: Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql…

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sy...

PT-2026-133492

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sy...

PT-2026-133621

Name of the Vulnerable Software and Affected Versions Scribus versions prior to 1.6.7 Scribus versions 1.7.x prior to 1.7.4 Description A heap buffer overflow occurs in the Mac PICT image loader and import plugin during the unpacking of 4-bit indexed pixel data. A heap buffer overflow is a memory...

CVE-2026-118071: Unknown Joinchat: The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an…

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including...

CVE-2026-117571: Unknown WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data…

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web script...