CVE-2026-19719 Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Contributor+ Stored XSS via Post Title

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...

CVE-2026-19116

The User Frontend WordPress plugin before version 4.3.11 is vulnerable to PHP Object Injection because it fails to prevent the deserialization of user-supplied field values. This occurs when a submitted post is reopened within its frontend editing form. Attackers with subscriber-level access or h...

WordPress Gutentor plugin < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure vulnerability

Subscriber+ Password Protected Post Password Disclosure vulnerability discovered by Ezekiel Victor in WordPress Plugin Gutentor versions 4.0.6...

CVE-2026-19116 WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

EUVD-2026-69869

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

WordPress Booking for Appointments and Events Calendar plugin < 2.4.9 - Unauthenticated Post-Booking Action Trigger vulnerability

Unauthenticated Post-Booking Action Trigger vulnerability discovered by Haitam Lazaar in WordPress Plugin Amelia versions 2.4.9...

CVE-2026-14215 Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

CVE-2026-14215 Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

CVE-2026-14215

The Booking for Appointments and Events Calendar WordPress plugin (Amelia) versions before 2.4.9 is vulnerable to an unauthenticated post-booking action trigger. The root cause is a lack of authentication or valid request token verification before executing the post-booking action chain . An unau...

GHSA-FMGR-6GGQ-9859

creationtimestamp| type| source ---|---|--- 2026-09-02 04:01:17+00:00| seen| https://bsky.app/profile/slackers.it/post/3muj2f6r4672h...

CVE-2026-84484

creationtimestamp| type| source ---|---|--- 2026-09-02 03:02:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/epaydyhordnwe 2026-09-02 05:01:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muj5qtlzon27 2026-09-02 05:01:31+00:00| seen|...

CVE-2026-84485

creationtimestamp| type| source ---|---|--- 2026-09-02 03:00:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bebidaz3dknh4 2026-09-02 08:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mujhrsnoe62q...

CVE-2026-84715

creationtimestamp| type| source ---|---|--- 2026-09-02 02:54:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fykkc3x3o3xls 2026-09-02 08:01:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mujhrzlupg2q 2026-09-02 14:00:06+00:00| seen|...

CVE-2026-80047

creationtimestamp| type| source ---|---|--- 2026-09-02 02:49:01+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3muiwdwyln52l 2026-09-02 07:30:52+00:00| seen| https://bsky.app/profile/newsfacts.bsky.social/post/3mujg3vvro22j...

CVE-2026-84696

creationtimestamp| type| source ---|---|--- 2026-09-02 02:07:51+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3muiu2dxz5j2b 2026-09-02 13:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muk3c2gkkj22...

CVE-2026-84427

creationtimestamp| type| source ---|---|--- 2026-09-02 01:37:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7aprxbp36hk3j...

GHSA-68JX-F42C-7599

creationtimestamp| type| source ---|---|--- 2026-09-02 01:12:28+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3muiqxcx7yt2y...

EUVD-2026-69707

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to...

CVE-2026-77124: Incomplete List of Disallowed Inputs

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...

Vesta Control Panel Command Execution

The vulnerability of the Vesta Control Panel’s control panel lies in the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the vsftplicense parameter when sending HTTP POST requests to the...