CVE-2026-65901

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...

CVE-2026-65540

Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...

CVE-2026-65537

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...

CVE-2026-65531

Unauthenticated Broken Access Control in Qubely = 1.8.14 versions...

CVE-2026-65535

Contributor Sensitive Data Exposure in TinyMCE Templates = 4.8.1 versions...

CVE-2026-65524

Contributor Broken Access Control in Avada Custom Branding = 1.2 versions...

CVE-2026-65526

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1...

CVE-2026-65510

Unauthenticated Cross Site Scripting XSS in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65503

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65505

Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65482

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows DOM-Based XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.3...

CVE-2026-65479

Subscriber Broken Access Control in Reviewer = 3.14.2 versions...

CVE-2026-65449

Contributor Cross Site Scripting XSS in MapSVG = 8.14.0 versions...

CVE-2026-65451

Contributor SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-59554

Unauthenticated Broken Authentication in Ziina = 1.2.21 versions...

CVE-2026-59540

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.6 versions...

CVE-2026-59525

Unauthenticated SQL Injection in Participants Database = 2.7.8.3 versions...

CVE-2026-59514

Unauthenticated SQL Injection in Buddyboss Platform = 3.0.5 versions...

CVE-2026-57696

Contributor Arbitrary File Deletion in Picture Gallery = 1.6.5 versions...

CVE-2026-57716

Unauthenticated Arbitrary File Deletion in Broadcast Live Video = 7.2.4 versions...