WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetElements For Elementor versions = 2.9.2.5...

WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Deva Parekh in WordPress Plugin Media LIbrary Assistant versions = 3.42...

WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Tang in WordPress Plugin Lazy Load for Videos versions = 2.18.11...

cantina

ARCHIVED. This project moved tocustom-oscp-tooling. All Cantina code lives on there now, alongside the Star Wars enum/advisor tool suite. This repo is kept read-only for history. New home: https://gitlab.com/WattoCyber/custom-oscp-tooling Run: python tools/cantina.py from that repo Cantina At a...

WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Khanh Nguyen in WordPress Plugin Media LIbrary Assistant versions = 3.42...

WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Sangho Lee in WordPress Plugin Booking and Rental Manager versions = 2.8.2...

WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ihsan Saddan in WordPress Plugin Image Gallery block – Create and display photo gallery/photo album. versions = 2.4.1...

CLSA-2026-1793007594 TuxCare security update for linkify-plugin-mention (1 CVE)

TuxCare rebuilt linkify-plugin-mention to address 1 CVE. Fixed in 4.1.3-tuxcare.1...

WordPress GeoDirectory plugin < 2.8.194 - Subscriber+ Media File Disclosure and Deletion vulnerability

Subscriber+ Media File Disclosure and Deletion vulnerability discovered by vuxvinh in WordPress Plugin GeoDirectory versions 2.8.194...

WordPress Datawiza Proxy Auth Plugin plugin < 1.1.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Datawiza Proxy Auth Plugin versions 1.1.1...

CVE-2026-103300 Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending...

CVE-2026-111974 GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency

The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount...

CVE-2026-111974

The GiveWP WordPress plugin versions prior to 4.19.0.1 is vulnerable to an unauthenticated donation amount restriction bypass . The root cause is that the plugin fails to restrict the donation currency to the specific currency accepted by the site or form. Instead, it compares amount limits as ba...

CVE-2026-111974 GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency

The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount...

Malicious code in dsh-plugin-blender-3d (npm)

[email protected] is a new release of a DeepSeek Harness plugin for Blender 3D modeling whose only change from 0.2.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to...

Malicious Package

Overview dsh-plugin-blender-3d is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-103319

The OPay Payment Gateway for WooCommerce WordPress plugin (versions

CVE-2026-103306

The Online Payments with iK Pay Gateway WordPress plugin (versions before 3.0.4 ) is vulnerable to an Unauthenticated Order Payment Forgery vulnerability. The flaw exists because the plugin fails to properly verify the authenticity of its payment gateway callback on a default installation. This a...

CVE-2026-103319 OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and...

CVE-2026-103319 OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and...