CVE-2026-57624: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in Blocksy Companion Pro = 2.1.46 versions...

CVE-2026-57426: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Modula - PRO = 2.10.8 versions...

VulnCheck KEV: CVE-2026-58480

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the saveattachments function exposed through the Advanced Reviews feature. Attackers can...

PT-2026-55007

Unauthenticated Cross Site Scripting XSS in Modula - PRO = 2.10.8 versions...

WordPress Modula - PRO plugin <= 2.10.8 - Cross Site Scripting (XSS) vulnerability

WordPress Modula - PRO plugin = 2.10.8 - Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Modula - PRO versions = 2.10.8...

CVE-2026-12224

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via updatecapabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the updatecapabilities REST handler accepting arbitrary capability strings from the request body and passing them directly to...

CVE-2026-12224 Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via updatecapabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the updatecapabilities REST handler accepting arbitrary capability strings from the request body and passing them directly to...

CVE-2026-12224

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via updatecapabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the updatecapabilities REST handler accepting arbitrary capability strings from the request body and passing them directly to...

CVE-2026-12224 Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via updatecapabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the updatecapabilities REST handler accepting arbitrary capability strings from the request body and passing them directly to...

CVE-2026-12224

The CVE-2026-12224 entry concerns the Dokan Pro plugin for WordPress. The vulnerability arises in the update_capabilities REST endpoint, which accepts arbitrary capability strings from the request body and passes them to WP_User::add_cap() without allowlist validation, with only the caller’s doka...

EUVD-2026-40928

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via updatecapabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the updatecapabilities REST handler accepting arbitrary capability strings from the request body and passing them directly to...

EUVD-2026-40912

The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'storeservicedate' parameter of the bpaassignstaffmembertoslots function in versions up to and including 5.7.1. This is due to the explicit use of stripslashesdeep on user-supplied POST data befor...

PT-2026-54510

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update capabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the update capabilities REST handler accepting arbitrary capability strings from the request body and passing them directly to...

Siemens Mendix Studio Pro arbitrary code execution vulnerability

Mendix Studio Pro is a low-code IDE designed for professional developers. It is a visual model-driven development environment used to build applications on the Mendix platform. Siemens Mendix Studio Pro has a vulnerability where arbitrary code can be executed. Attackers can exploit this...

CVE-2026-12224: Improper Privilege Management

The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via updatecapabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the updatecapabilities REST handler accepting arbitrary capability strings from the request body and passing them directly to...

CVE-2026-11823: Improper Neutralization of Special Elements used in an SQL Command

The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'storeservicedate' parameter of the bpaassignstaffmembertoslots function in versions up to and including 5.7.1. This is due to the explicit use of stripslashesdeep on user-supplied POST data befor...

CVE-2026-48192

A vulnerability has been identified in Mendix Studio Pro 10.11 All versions, Mendix Studio Pro 10.12 All versions, Mendix Studio Pro 10.13 All versions, Mendix Studio Pro 10.14 All versions, Mendix Studio Pro 10.15 All versions, Mendix Studio Pro 10.16 All versions, Mendix Studio Pro 10.17 All...

CVE-2026-48192

A vulnerability has been identified in Mendix Studio Pro 10.11 All versions, Mendix Studio Pro 10.12 All versions, Mendix Studio Pro 10.13 All versions, Mendix Studio Pro 10.14 All versions, Mendix Studio Pro 10.15 All versions, Mendix Studio Pro 10.16 All versions, Mendix Studio Pro 10.17 All...

CVE-2026-48192

A vulnerability has been identified in Mendix Studio Pro 10.11 All versions, Mendix Studio Pro 10.12 All versions, Mendix Studio Pro 10.13 All versions, Mendix Studio Pro 10.14 All versions, Mendix Studio Pro 10.15 All versions, Mendix Studio Pro 10.16 All versions, Mendix Studio Pro 10.17 All...

CVE-2026-48192

A vulnerability has been identified in Mendix Studio Pro 10.11 All versions, Mendix Studio Pro 10.12 All versions, Mendix Studio Pro 10.13 All versions, Mendix Studio Pro 10.14 All versions, Mendix Studio Pro 10.15 All versions, Mendix Studio Pro 10.16 All versions, Mendix Studio Pro 10.17 All...