295285 matches found
CVE-2026-54866: Razorpay Razorpay Payment Button Elementor Plugin: Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.
Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button Elementor Plugin = 1.2.8 versions...
Apache Struts2 JSON Deserialization Denial of Service Hardening Bypass
Apache Struts2's JSON plugin is reportedly susceptible to denial of service conditions due to insufficient resource consumption controls during recursive JSON deserialization. Despite the introduction of depth, element count, and input length restrictions through WW-5618 and S2-072, the...
CVE-2026-80069: Stylemix MasterStudy LMS WordPress Plugin: MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any…
MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...
VulnCheck KEV: CVE-2026-96662
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...
CVE-2026-114173: canva ortto: The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public…
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store...
PT-2026-132458
OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones,...
CVE-2026-105258: Unknown Appointment Booking Plugin: The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings…
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads...
CVE-2026-114270: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing,…
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password...
CVE-2026-110505: Unknown: The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG…
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site...
PT-2026-132098
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
CVE-2026-96767: webaways NEX-Forms – Ultimate Forms Plugin for WordPress: The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting…
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
Apache Struts 2 REST Plugin 7.4.0 Chunked Request Body Handling
Apache Struts 2 REST Plugin version 7.4.0 and below skips request-body deserialization and maximum-length enforcement when requests use chunked transfer encoding without a Content-Length header...
CVE-2026-80067: Stylemix MasterStudy LMS WordPress Plugin: MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated…
MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...
CVE-2026-103693: Unknown: The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an…
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to...
CVE-2026-113409: canva ortto: The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to…
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted...
Canva ortto cross-site scripting vulnerability
Versions of Canva Ortto prior to 1.0.25 contain a cross-site scripting vulnerability. This flaw stems from the lack of escaping of settings stored on the administration page, potentially enabling stored cross-site scripting attacks. Attackers can modify plugin configurations and execute arbitrary...
GHSA-W658-MH9P-WW8F Backstage catalog rules can be bypassed for URL locations using encoded path segments
Summary @backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it...
@backstage/backend-dynamic-feature-service (>=0.8.8-next.0, <=0.8.8-next.1), @backstage/plugin-catalog-backend-module-incremental-ingestion (>=0.9.0-next.0, <=0.9.0-next.1) +2 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=4.0.1-next.0, <=4.0.1-next.1)
@backstage/plugin-catalog-backend NPM version =4.0.1-next.0, =0.8.8-next.0, =0.9.0-next.0, =0.1.27-next.0, =0.1.5-next.0, =0.1.5-next.1 Source cves: CVE-2026-115923 Source advisory: OSV:GHSA-W658-MH9P-WW8F...
@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.1), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.2-next.0)
@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.4-next.0 Source cves: CVE-2026-115923 Source advisory: GHSA-W658-MH9P-WW8F...
@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.1), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.2-next.0)
@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.4-next.0 Source cves: CVE-2026-115923 Source advisory: OSV:GHSA-W658-MH9P-WW8F...