CVE-2026-92099

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...

Cross-site Scripting (XSS)

Semantic MediaWiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to attacker-controlled query input being reflected into raw HTML without proper output encoding, which allows an unauthenticated attacker to inject malicious scripts through a crafted query and execute them in ...

CVE-2026-92099

The WPGraphQL Smart Cache WordPress plugin (versions before 2.3.2 ) is vulnerable to an improper access control issue. The plugin fails to require authorization or validate caller-supplied query identifiers when storing persisted queries from a request. This allows unauthenticated users to publis...

EUVD-2026-83510

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...

CVE-2026-92099 WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...

CVE-2026-92099 WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...

PT-2026-95871

Name of the Vulnerable Software and Affected Versions olivier-ls PHP-FTS versions prior to 1.1.3 Description A flaw in the Search Engine component allows remote attackers to perform cross-site scripting XSS by manipulating the Query argument. The issue resides within the...

CVE-2026-6295: Improper Neutralization of Special Elements used in an SQL Command

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parsekeycomparefield method that, when the user-supplied value matches the regex ^\sSELECT\s+, wra...

PT-2026-95763

Name of the Vulnerable Software and Affected Versions WPGraphQL Smart Cache versions prior to 2.3.2 Description The plugin fails to require authorization or validate the caller-supplied query identifier when storing a persisted query from a request. This allows unauthenticated users to publish...

CVE-2026-92099: Improper Access Control

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...

PT-2026-95790

Name of the Vulnerable Software and Affected Versions WP Optimizer versions prior to 2.5.1 Description Authenticated attackers with administrator-level access can perform SQL Injection through the 's' parameter. The issue occurs in the parse key compare field function of the Query class, where a...

CVE-2026-76579: Improper Neutralization of Input During Web Page Generation

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-93956: Improper Neutralization of Input During Web Page Generation

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launche...

CVE-2026-93759

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2026-93760

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the databas...

CVE-2026-93761

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query...

CVE-2026-63445

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63458

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

GHSA-CJGJ-2FWF-4C2W Perses's project query parameter authorization bypass exposes cross-project resources

Impact What kind of vulnerability is it? An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret or simply GET /api/v1/datasources?project=finance-secret and receives the full list of the finance-secret project's dashboar...

Perses's project query parameter authorization bypass exposes cross-project resources

Impact What kind of vulnerability is it? An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret or simply GET /api/v1/datasources?project=finance-secret and receives the full list of the finance-secret project's dashboar...