CVE-2026-4804

The Zakra WordPress theme (

CVE-2026-4804

The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields zakramenuitemcolor, zakramenuitemhovercolor, and zakramenuitemactivecolor with 'showinrest' = tr...

CVE-2026-11900

The CVE-2026-11900 entry concerns the WordPress plugin Ad Inserter – Ad Manager & AdSense Ads up to version 2.8.16. It is vulnerable to an Insecure Direct Object Reference via the shortcodes’ data attribute. The replace_ai_tags() function processes a {reusable-block-N} pattern by calling get_post...

CVE-2026-11900

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the adinserter shortcode. This is due to the replaceaitags function processing a reusable-block-N tag pattern that...

EUVD-2026-41520

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the adinserter shortcode. This is due to the replaceaitags function processing a reusable-block-N tag pattern that...

CVE-2026-11900 Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the adinserter shortcode. This is due to the replaceaitags function processing a reusable-block-N tag pattern that...

CVE-2026-53358

creationtimestamp| type| source ---|---|--- 2026-07-03 07:15:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppyrs72po2n...

CVE-2026-50748

creationtimestamp| type| source ---|---|--- 2026-07-03 07:06:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppybm6qum2k 2026-07-03 21:35:42+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpriuhp4u22r 2026-07-08 11:01:21+00:00| seen|...

CVE-2026-8921

creationtimestamp| type| source ---|---|--- 2026-07-03 06:42:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppwxkbkw72u 2026-07-03 19:36:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mprc7nvnqc2n...

CVE-2026-9626

The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the postcomment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the postcomment function, which passes the attacker-controlled...

CVE-2026-13040

creationtimestamp| type| source ---|---|--- 2026-07-03 05:56:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppuf2z6mv2w 2026-07-03 11:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpqgakvqjn2x 2026-07-03 11:17:22+00:00| seen|...

CVE-2026-57351

creationtimestamp| type| source ---|---|--- 2026-07-03 05:11:24+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mppruf5djs2n 2026-07-20 17:44:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr3tu2v4kz27 2026-07-21 03:44:08+00:00| seen|...

EUVD-2026-41490

The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the postcomment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the postcomment function, which passes the attacker-controlled...

CVE-2026-9626

The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the postcomment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the postcomment function, which passes the attacker-controlled...

CVE-2026-9626 JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter

The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the postcomment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the postcomment function, which passes the attacker-controlled...

CVE-2026-58652

creationtimestamp| type| source ---|---|--- 2026-07-03 04:04:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppo4hmy6r2j 2026-07-03 10:25:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqdguittd2n...

CVE-2026-4772

creationtimestamp| type| source ---|---|--- 2026-07-03 03:54:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppnkmjaf22n...

CVE-2025-69152

creationtimestamp| type| source ---|---|--- 2026-07-03 03:23:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppltpagqm2j...

CVE-2026-13373

creationtimestamp| type| source ---|---|--- 2026-07-03 03:16:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpplhrjxmc2i 2026-07-03 19:00:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpra6phkd22u...

CVE-2026-13375

creationtimestamp| type| source ---|---|--- 2026-07-03 03:11:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppl6t2q2w2a 2026-07-03 18:57:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpr7zfqp3e2b...