WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2sid' Parameter vulnerability discovered by s00me00ne in WordPress Plugin Blog2Social versions = 8.8.3...

CVE-2026-39575 WordPress Custom Query Blocks plugin <= 5.5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through = 5.5.0...

CVE-2026-39575 WordPress Custom Query Blocks plugin <= 5.5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through = 5.5.0...

CVE-2026-39575

CVE-2026-39575 affects the WordPress plugin “Custom Query Blocks” (Ronald Huereca) for the post-type-archive-mapping feature, with DOM-based XSS caused by improper neutralization of input during web page generation. Affected versions are

CVE-2026-39575

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through = 5.5.0...

CVE-2026-39482

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress Post Expirator post-expirator allows DOM-Based XSS.This issue affects Post Expirator: from n/a through = 4.9.4...

CVE-2026-39482 WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress Post Expirator post-expirator allows DOM-Based XSS.This issue affects Post Expirator: from n/a through = 4.9.4...

CVE-2026-39482 WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress Post Expirator post-expirator allows DOM-Based XSS.This issue affects Post Expirator: from n/a through = 4.9.4...

CVE-2026-39482

CVE-2026-39482 affects the WordPress plugin PublishPress Post Expirator (the post-expirator) with a DOM-based XSS vulnerability. Public sources describe it as impacting Post Expirator versions up to and including 4.9.4 (the range is stated as from n/a through

CVE-2026-4341

creationtimestamp| type| source ---|---|--- 2026-04-08 08:06:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mixtkafgqh2q...

CVE-2026-3646

creationtimestamp| type| source ---|---|--- 2026-04-08 07:47:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mixshoskua24...

CVE-2026-4330

The affected software is the Blog2Social: Social Media Auto Post & Scheduler WordPress plugin. All versions up to 8.8.3 are affected by an authorization bypass in AJAX handlers: the plugin does not validate that the user-supplied b2s_id belongs to the current user before UPDATE/DELETE actions. Th...

CVE-2026-4785

creationtimestamp| type| source ---|---|--- 2026-04-08 07:37:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mixrvlqwef2d...

CVE-2026-3480

The WP Blockade plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 0.9.14. The plugin registers an adminpost action hook 'wp-blockade-shortcode-render' that maps to the rendershortcodepreview function. This function lacks any capability check...

EUVD-2026-20046

The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'followustext' setting of the Mount widget in all versions up to, and including, 4.1.10. This is due to insufficient input sanitization and output escaping. Specifically, the...

CVE-2026-5301

creationtimestamp| type| source ---|---|--- 2026-04-08 04:16:43+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5301 2026-04-08 14:47:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyjy73k7v2g 2026-04-08 15:16:22+00:00| seen|...

CVE-2026-4402

creationtimestamp| type| source ---|---|--- 2026-04-08 04:16:42+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4402 2026-04-08 14:22:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyikiheiv2q...

CVE-2026-27102

creationtimestamp| type| source ---|---|--- 2026-04-08 04:16:41+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-27102 2026-04-08 15:07:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyl2qbupd2i...

CVE-2026-39411

creationtimestamp| type| source ---|---|--- 2026-04-08 02:20:20+00:00| published-proof-of-concept| https://github.com/lobehub/lobehub/security/advisories/GHSA-5mwj-v5jw-5c97 2026-04-08 22:21:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizddehwyw2t...

AZL-98625 CVE-2026-32283 affecting package golang 1.27.1-1

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3...