CVE-2025-40897

creationtimestamp| type| source ---|---|--- 2026-04-15 13:35:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjz7ahxmz2o 2026-04-15 17:00:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjkeneidmd2h 2026-04-17 17:30:59+00:00| published-proof-of-concept|...

CVE-2026-5598

creationtimestamp| type| source ---|---|--- 2026-04-15 13:25:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjyndbx2b2x 2026-04-17 17:30:59+00:00| published-proof-of-concept| Telegram/TfvL4UdHtH3ZuzBSEbo8ShneR8BWZRWY3OJLSl5lBMznWjk 2026-08-13 08:47:42+00:00| seen|...

CVE-2025-14813

creationtimestamp| type| source ---|---|--- 2026-04-15 13:04:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjxh2c67m2t...

CVE-2026-40763

creationtimestamp| type| source ---|---|--- 2026-04-15 12:23:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjv6qetns2m...

CVE-2026-40734

creationtimestamp| type| source ---|---|--- 2026-04-15 12:12:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjujs7h272t...

CVE-2026-5717

The VI: Include Post By plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'classcontainer' attribute of the 'include-post-by-cat' shortcode in all versions up to, and including, 0.4.200706 due to insufficient input sanitization and output escaping on user supplied...

CVE-2026-3649

The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.0. The katalogportalpopupshortcode function is registered as an AJAX handler via wpajaxkatalogportalshortcodePrinter but lacks any capability check currentusercan or nonc...

CVE-2026-5160

creationtimestamp| type| source ---|---|--- 2026-04-15 08:22:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjhpqp6t72m 2026-04-23 14:15:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mk675fasgt2h...

CVE-2026-5717

The CVE-2026-5717 entry concerns the WordPress plugin VI: Include Post By. Affected: all versions up to 0.4.200706. Issue: Stored Cross-Site Scripting via the class_container attribute of the include-post-by-cat shortcode, caused by insufficient input sanitization and output escaping on user-supp...

CVE-2026-5717 VI: Include Post By <= 0.4.200706 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_container' Shortcode Attribute

The VI: Include Post By plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'classcontainer' attribute of the 'include-post-by-cat' shortcode in all versions up to, and including, 0.4.200706 due to insufficient input sanitization and output escaping on user supplied...

CVE-2026-5717

The VI: Include Post By plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'classcontainer' attribute of the 'include-post-by-cat' shortcode in all versions up to, and including, 0.4.200706 due to insufficient input sanitization and output escaping on user supplied...

CVE-2026-1541

creationtimestamp| type| source ---|---|--- 2026-04-15 04:39:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjj3ag6qgm2m 2026-07-15 10:01:31+00:00| seen| https://bsky.app/profile/bsi.bund.de/post/3mqoho555k222 2026-07-15 10:27:25+00:00| seen|...

CVE-2026-39984

creationtimestamp| type| source ---|---|--- 2026-04-15 04:24:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjj2gkkbn72w...

CVE-2026-4812

The Advanced Custom Fields ACF plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions witho...

CVE-2026-1541

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's fusiongetpostcustomfield function failing to validate whether metadata keys are protected underscore-prefixed. This makes it...

CVE-2026-40104

creationtimestamp| type| source ---|---|--- 2026-04-15 04:17:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjizz246yu2o 2026-04-16 17:20:51+00:00| seen| Telegram/s117pb2GT3VwdfXaV13Oi8Gqr-ePRyI5oBJZVU7ek3MbpQ 2026-04-23 15:37:07+00:00| seen|...

WordPress VI: Include Post By plugin <= 0.4.200706 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_container' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'classcontainer' Shortcode Attribute vulnerability discovered by MAJidox in WordPress Plugin VI: Include Post By versions = 0.4.200706...

CVE-2026-33807

creationtimestamp| type| source ---|---|--- 2026-04-15 01:50:12+00:00| published-proof-of-concept| https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c 2026-04-15 10:02:22+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mjjnbuzv622t 2026-04-15...

CVE-2026-4812

The Advanced Custom Fields ACF plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions witho...

CVE-2026-1541 Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's fusiongetpostcustomfield function failing to validate whether metadata keys are protected underscore-prefixed. This makes it...