CVE-2026-95153

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

CVE-2026-95153

A vulnerability exists in Bludit CMS 3.22.0 that allows a remote attacker to obtain sensitive information . The issue is accessible via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints. No specific root cause, exploit details, or remediation steps are provided in the available docum...

EUVD-2026-93552

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

CVE-2026-95153

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

CVE-2026-92807

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...

EUVD-2026-83481

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...

CVE-2026-92807 Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...

CVE-2026-92807

The Save as PDF Plugin by PDFCrowd for WordPress (≤ 4.6.1) is vulnerable to arbitrary function invocation via the pdf_created_callback shortcode attribute. The eval_shortcode() function copies attacker-supplied attributes into an options array without sanitization or allowlist enforcement. When t...

CVE-2026-92807 Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...

CVE-2026-92807: Improper Control of Generation of Code

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...

PT-2026-95747

Name of the Vulnerable Software and Affected Versions Save as PDF Plugin by PDFCrowd versions prior to 4.6.2 Description The plugin is susceptible to Arbitrary Function Invocation. The eval shortcode function copies shortcode attributes into a custom options array without sanitization or capabili...

WordPress Save as PDF Plugin by PDFCrowd plugin <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute vulnerability

Authenticated Contributor+ Arbitrary Function Invocation / Code Injection via 'pdfcreatedcallback' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Save as PDF versions = 4.6.1...

CVE-2026-85603

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...

EUVD-2026-71026

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...

CVE-2026-85603 Grav Admin Plugin Path Traversal via Save As Language Code

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...

CVE-2026-85603 Grav Admin Plugin Path Traversal via Save As Language Code

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...

CVE-2026-85603

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action. The root cause is a missing validation of the language code (lang) POST field, allowing an authenticated user with the admin.pages.create permission to inject directory traversal sequences. T...

PT-2026-85503

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.10.55 Description A path traversal issue exists in the admin plugin's Save As action due to improper validation of the language code parameter. An authenticated admin user with admin.pages.create permission can use...

CVE-2026-14906 Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4...

WordPress Save as PDF Plugin by PDFCrowd plugin <= 4.5.5 - Reflected Cross-Site Scripting via options vulnerability

Reflected Cross-Site Scripting via options vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Save as PDF versions = 4.5.5...