CVE-2026-61961: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...

CVE-2026-61959: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...

CVE-2026-28178: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Powerkit = 3.1.0 versions...

CVE-2026-28169: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier = 2.52.0 versions...

CVE-2026-28143: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Forminator = 1.56.0 versions...

CVE-2026-28177: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Popup Maker = 1.23.0 versions...

CVE-2026-28140: Missing Authorization

Unauthenticated Broken Access Control in JetFormBuilder = 3.6.4.1 versions...

CVE-2026-5430: Improper Verification of Cryptographic Signature

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this...

CVE-2026-65575: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Accalia = 1.5.3 versions...

CVE-2026-66440: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WPIDE – File Manager & Code Editor = 3.5.7 versions...

CVE-2026-65541: Missing Authorization

Unauthenticated Broken Access Control in Staff Training = 1.0.7 versions...

CVE-2026-65569: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...

CVE-2025-11850: Authorization Bypass Through User-Controlled Key

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...

CVE-2026-66684: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-66685: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...

CVE-2026-65548: Improper Control of Generation of Code

Contributor Remote Code Execution RCE in Betheme = 28.4.2 versions...

CVE-2026-34502: Heap-based Buffer Overflow

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...

CVE-2026-65573: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Abelle = 1.22 versions...

CVE-2025-14561: Improper Access Control

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publishe...

CVE-2026-18915: Invocation of Process Using Visible Sensitive Information

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...