WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mj404error in WordPress Plugin Page Restriction WordPress WP versions = 1.6.1...

WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Flash & HTML5 Video versions = 2.14.0...

WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin Media LIbrary Assistant versions = 3.42...

CVE-2026-80069 MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...

EUVD-2026-112859

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...

CVE-2026-80067 MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...

EUVD-2026-112926

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...

WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability

Content Injection vulnerability discovered by Peter Tang in WordPress Plugin Brave versions = 0.8.8...

WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Site Reviews versions = 8.3.5...

Cross-site Scripting (XSS)

TinyMCE is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to processing elements created through data-mce-object in the active document before sanitization, which allows an attacker to inject malicious scripts that execute during media processing and cause stored XSS in...

CVE-2026-96767

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-96767

The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 9.3.2 . The root cause is insufficient input sanitization and output escaping related to the 'type' parameter . This flaw allows unauthenticated attackers to ...

EUVD-2026-112745

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2024-7856

CVE-2024-7856 ★ CVE-2024-7856 Arbitrary File deletion PoC ★ Description CVE-2024-7856 : MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar -f python3 CVE-2024-7856.py -u -f -i -p Example python3 CVE-2024-7856.py -u http://example.com/ -f /tmp/test python3 CVE-2024-7856.py -u...

WordPress ProfileGrid plugin < 6.0.0.5 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by sungbyeongchan in WordPress Plugin ProfileGrid versions 6.0.0.5...

OESA-2026-4594 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

OESA-2026-4593 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

OESA-2026-4592 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

BIT-OPENBAO-2026-115366 OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones,...

BIT-OPENBAO-2026-115358 OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitiv...