Shield Security WP Plugin <= 18.5.9 - Local File Inclusion

The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the renderactiontemplate parameter. This makes it possible for unauthenticated attacker to include and execute PHP fil...

YesWiki < 4.7.0 - Unauthenticated Server-Side Request Forgery

YesWiki 4.7.0 contains an unauthenticated server-side request forgery caused by improper handling of |URL wiki syntax in the render handler, letting remote attackers fetch arbitrary URLs, exploit requires no authentication. id: CVE-2026-116205 info: name: YesWiki 4.7.0 - Unauthenticated Server-Si...

Geo Mashup <= 1.13.18 - SQL Injection

Geo Mashup WordPress plugin = 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths. id: CVE-2026-4060 info: name: Geo Mashup = 1.13.18 - SQL Injection author:...

CVE-2026-119751

Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permissioncheck improperly...

CVE-2026-119751 Content Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks

Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permissioncheck improperly...

CVE-2026-119751

The Content Egg plugin for WordPress before version 12.1.0 is vulnerable to an unauthenticated information disclosure due to broken access control. The issue resides in the permission_check() function of the REST route POST /wp-json/content-egg/v1/render-blocks, which incorrectly returns true if ...

EUVD-2026-117550

Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permissioncheck improperly...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. Resources https://vulners.com/cve/CVE-2016-2098 Usage To use this...

CVE-2026-104812

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multimedia' Field Array Key in all versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject...

EUVD-2026-117328

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multimedia' Field Array Key in all versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject...

CVE-2026-104812

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions. The vulnerability exists because the wp_kses_post sanitization during save operations only targets array leaf values, leaving array keys unsanitized. An authenticated attacker with subscri...

CVE-2026-104812 Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multimedia' Field Array Key in all versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject...

CVE-2026-97701

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...

CVE-2026-97701

Zulip Server versions through 12.1 are vulnerable to a resource exhaustion issue in the POST /messages/render endpoint. The vulnerability occurs because the content parameter is rendered without enforcing the standard message length limits applied to message send and edit operations. An authentic...

CVE-2026-97701 Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...

CVE-2026-97701 Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...

EUVD-2026-117032

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...

CVE-2026-57853

DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the templatedata field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja...

EUVD-2026-117011

DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the templatedata field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja...

CVE-2026-121632

Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping. processattrs writes each attribute value into the markup as is. The select, radio group and checkbox group renderers pass each option to it, so an option's value becomes an unescaped...