Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)

Last week, there were 295 vulnerabilities disclosed in 196 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 159 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2026-89046

creationtimestamp| type| source ---|---|--- 2026-09-10 19:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv6qffx5pc2s...

CVE-2026-85228

creationtimestamp| type| source ---|---|--- 2026-09-10 18:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv6mzwzcxb2k 2026-09-11 05:50:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv7uo3diay24...

CVE-2026-81048

creationtimestamp| type| source ---|---|--- 2026-09-10 17:10:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6k74ekp52p 2026-09-10 18:08:10+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6ngve7p42n 2026-09-17 07:07:07+00:00| seen|...

CVE-2026-80352

creationtimestamp| type| source ---|---|--- 2026-09-10 17:00:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6jnakqqt2r 2026-09-11 14:13:08+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mvaqrk47fz2o 2026-09-15 04:37:08+00:00| seen|...

CVE-2026-88921

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...

CVE-2026-88921

MISP (versions ≤2.5.45) contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, used during PDF report export via the convert_markdown_to_pdf module. The attribute(), objectAttribute(), object(), and tag() methods interpolated user-controlled fields (attribute type...

CVE-2026-88921 MISP: Unescaped HTML Injection in PDF Report Element Rendering

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...

CVE-2026-88893

OpenPanel 's share lookup procedures fail to validate access controls, allowing unauthenticated callers who possess a share link to retrieve argon2id password hashes and full report configurations (event names, filters, breakdown dimensions). This enables offline password cracking and theft of bu...

CVE-2026-88893 OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters,...

casc-analys

💜 Что такое CASC-ANAYS? CASC-ANAYS — это модульный аналитиче...

casc-anays

💜 Что такое CASC-ANAYS? CASC-ANAYS — это модульный аналитиче...

CVE-2026-37004

creationtimestamp| type| source ---|---|--- 2026-09-10 12:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv634bqngq2f...

CVE-2026-84828

creationtimestamp| type| source ---|---|--- 2026-09-10 12:03:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dfxcpbhrx35ue 2026-09-11 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mvai73fffe22...

CVE-2026-8323

creationtimestamp| type| source ---|---|--- 2026-09-10 10:05:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/cgolcynnqt54y 2026-09-10 10:08:04+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv5smfebby2n 2026-09-10 10:20:06+00:00| seen|...

CVE-2026-88285

creationtimestamp| type| source ---|---|--- 2026-09-10 10:03:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6knaxpydzctnd 2026-09-10 10:07:52+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv5sm2o7xx2n 2026-09-10 10:30:10+00:00| seen|...

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

SummaryProwler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

CVE-2026-79941

creationtimestamp| type| source ---|---|--- 2026-09-10 03:20:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv53suqsbe2y...

PT-2026-89404

OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown...

CVE-2026-88893: Exposure of Sensitive Information to an Unauthorized Actor

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters,...