CVE-2026-117532 REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

CVE-2026-117532

REDAXO core versions 5.3.0 through 5.21.4 are vulnerable to an authentication bypass within the structure/history plugin. This flaw allows unauthenticated attackers to force the session-tied secret into a predictable state , enabling the forgery of temporary login tokens. An attacker can leverage...

CVE-2026-117532 REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Peter Tang in WordPress Plugin Login with phone number versions = 1.8.78...

WordPress Payment Integration Wompi plugin <= 4.0.1 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payment Integration Wompi versions = 4.0.1...

REDAXO CMS core cross-site request forgery vulnerability

REDAXO CMS versions prior to core 5.21.3 contain a cross-site request forgery vulnerability. This flaw stems from the structure/history plugin’s failure to validate GET requests, making it susceptible to such attacks. It could allow attackers to trick logged-in users into triggering func=clearall...

PT-2026-126369

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex history...

Spesmilo Electrum encryption issue vulnerability

Versions prior to spesmilo electrum 4.7.2, specifically 4.6.0, contain an encryption-related vulnerability. This flaw arises because the external plugin loader executes the init.py module marked as enabled without first verifying the plugin’s password signature. As a result, malicious local...

PT-2026-127751

Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled. Patches This vulnerability has been...

CVE-2026-118132: Undefined Security Weakness

NextChat version 2.16.1 contains a client‑side cross‑site scripting XSS vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, the returned content is stored in plugin.content and later...

REDAXO CMS core authorization issue vulnerability

Versions of REDAXO CMS prior to core 5.21.5 contain an authorization issue vulnerability. This flaw stems from the backup plugin’s export functionality lacking proper authorization checks; it allows unrestricted export of database tables. Non-administrative users possessing the backupexport...

CVE-2026-116675: Improper Neutralization of Input During Web Page Generation

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...

PT-2026-126432

Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init .py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data...

PT-2026-127186

NextChat version 2.16.1 contains a client‑side cross‑site scripting XSS vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, the returned content is stored in plugin.content and later...

PT-2026-126417

The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync,...

PT-2026-126686

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...

NextChat cross-site scripting vulnerability

Version 2.16.1 of NextChat contains a cross-site scripting vulnerability. This arises because the Plugin Editor fails to properly sanitize HTML or JavaScript tags within externally supplied OpenAPI plugin schemas. As a result, attackers can trick users into loading malicious schemas and executing...

TinyMCE cross-site scripting vulnerability

Versions of TinyMCE prior to 7.9.3 and from 8.5.1 up to 8.9.3 contain a cross-site scripting vulnerability. This vulnerability arises because the media plugin creates specially crafted elements within active documents via data-mce-object before cleanup; these elements can execute malicious script...

PT-2026-127812

Name of the Vulnerable Software and Affected Versions Product Designer for WooCommerce WordPress | Lumise plugin for WordPress versions prior to 2.1.3 Description An issue exists that allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive informatio...

WPProbe Plugin Enumeration Tool 0.12.13

A fast WordPress plugin and theme scanner that detects installed plugins via REST API enumeration and themes from HTML discovery, then maps them to known vulnerabilities. Over 5,000 plugins detectable without brute-force, thousands more with it...