CVE-2026-6227

CVE-2026-6227: Local File Inclusion in BackWPup Advisory Summary BackWPup versions up to and including 5.6.6 are affected by an authenticated Local File Inclusion LFI vulnerability via the blockname parameter of the /wp-json/backwpup/v1/getblock REST endpoint. The flaw was caused by non-recursive...

CVE-2026-120349

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function strreplace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched...

EUVD-2026-115071

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function strreplace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched...

CVE-2026-120349 dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function strreplace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched...

CVE-2026-120349

A security flaw exists in dayrui XunRuiCMS up to version 4.7.4 within the Mobile Site Directory component. The vulnerability is located in the str_replace function of the file /var/www/html/zzmob/index.php, where manipulating the dirname argument leads to code injection . This flaw can be exploit...

CVE-2026-120349 dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function strreplace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched...

PT-2026-135338

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched...

CVE-2026-120349: dayrui XunRuiCMS: A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function strreplace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched...

CVE-2026-97339 Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-97339: Improper Neutralization of Input During Web Page Generation

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-100196

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.4.0 . The root cause is insufficient input sanitization and output escaping within the comment_content parameter. Attackers can bypass Wor...

EUVD-2026-96211

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentcontent rendered inline into the page HTML' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escapin...

CVE-2026-100196 LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentcontent rendered inline into the page HTML' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escapin...

CVE-2026-100196: Improper Neutralization of Input During Web Page Generation

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentcontent rendered inline into the page HTML' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escapin...

CVE-2026-92580

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

WordPress: wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list

A vulnerability was discovered in the open redirect feature of a WordPress theme that serves a subdirectory site. The vulnerability was caused by incorrect use of a string replacement function where the fourth argument, intended to limit replacements to one occurrence, was actually interpreted as...

CVE-2026-47689

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the "buildRow" method in "fogpage.class.php" substitutes data values into HTML table cell templates using "strreplace" without any HTML escaping. An unauthenticat...

CVE-2026-47689: Improper Neutralization of Input During Web Page Generation

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow method in fogpage.class.php substitutes data values into HTML table cell templates using strreplace without any HTML escaping. An unauthenticated...

CVE-2026-10570: Improper Neutralization of Input During Web Page Generation

The Sympl Repeater for ACF and Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ACF repeater field values in all versions up to, and including, 2.3. This is due to insufficient input sanitization and output escaping in the symparfereplacecontent function, which uses...

CVE-2026-44418

EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput function's default case in EcclesiaCRM's query view passes user-supplied POST parameters directly into SQL queries via strreplace without any sanitization, enabling SQL injection through query parameters th...