CVE-2026-111367

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribene...

CVE-2026-111367: Use of Default Cryptographic Key

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribene...

PT-2026-115307

Name of the Vulnerable Software and Affected Versions BillionMail versions prior to 5.0 Description An issue exists where a hard-coded cryptographic key allows unauthenticated attackers to forge JSON Web Tokens JWTs by calculating the key from provided configuration constants. Attackers can use...

CVE-2026-103422

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

EUVD-2026-100779

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-103422 AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-103422 AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-103422

The AnyComment plugin for WordPress (versions up to and including 0.3.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw stems from insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and a lack of output escaping in the AnyCommentSubscripti...

CVE-2026-103422: Improper Neutralization of Input During Web Page Generation

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

PT-2026-113603

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-102562

The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acymcleanVar sanitizer,...

CVE-2026-102562 AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter

The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acymcleanVar sanitizer,...

CVE-2026-102562

The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 11.1.0 . The root cause is insufficient input sanitization and output escaping within the acym_cleanVar() sanitizer, which only strips complete HTML tags, combined with Subscribe...

CVE-2026-102562: Improper Neutralization of Input During Web Page Generation

The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acymcleanVar sanitizer,...

CVE-2026-91829

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators...

EUVD-2026-96793

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators...

CVE-2026-91829 Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators...

CVE-2026-91829

The Subscribe to Comments WordPress plugin (versions before 2.3.3 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is a failure to properly validate a parameter—specifically identified in some records as the 'ref' parameter —before reflecting it into a link target. This al...

CVE-2026-91829: Improper Neutralization of Input During Web Page Generation

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators...

MAL-2026-17344 Malicious code in @bellaxchuu/familyxtrx (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...