375 matches found
PT-2026-21153
Name of the Vulnerable Software and Affected Versions AncoraThemes SevenHills versions through 1.6.2 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. Recommendations Update AncoraThemes SevenHills to a version newer than 1.6.2...
CVE-2026-1925
The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'updatetemplatedata' function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with...
CVE-2026-1925
The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'updatetemplatedata' function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with...
CVE-2026-1925
The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on update_template_data in all versions up to 1.6.2. Authenticated attackers with Subscriber-level access and above can modify the title of a...
CVE-2026-1925 EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification
The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'updatetemplatedata' function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with...
WordPress Super Simple Contact Form plugin <= 1.6.2 - Reflected Cross-Site Scripting via 'sscf_name' Parameter vulnerability
Reflected Cross-Site Scripting via 'sscfname' Parameter vulnerability discovered by 0x34rth in WordPress Plugin Super Simple Contact Form versions = 1.6.2...
CVE-2026-0753
The Super Simple Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sscfname' parameter in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-0753
The Super Simple Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sscfname' parameter in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-0753
Product affected: WordPress plugin “Super Simple Contact Form” (WP repository plugin). Vulnerability: Reflected Cross-Site Scripting via the request parameter sscf_name . Root cause: Insufficient input sanitization and output escaping in all versions up to and including 1.6.2. Impact: Unauthentic...
CVE-2026-0753 Super Simple Contact Form <= 1.6.2 - Reflected Cross-Site Scripting via 'sscf_name' Parameter
The Super Simple Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sscfname' parameter in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-0753 Super Simple Contact Form <= 1.6.2 - Reflected Cross-Site Scripting via 'sscf_name' Parameter
The Super Simple Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sscfname' parameter in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
Known affected by Account Takeover via Password Reset Token Leakage
Summary A Critical Broken Authentication vulnerability exists in Known 1.6.2. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's...
GHSA-78WQ-6GCV-W28R Known affected by Account Takeover via Password Reset Token Leakage
Summary A Critical Broken Authentication vulnerability exists in Known 1.6.2. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's...
CVE-2026-26273
Known (social publishing platform) prior to version 1.6.3 contains a critical Broken Authentication weakness in 1.6.2 and earlier: the password reset token is leaked in a hidden HTML input field on the password reset page, allowing unauthenticated attackers to retrieve the token by querying the u...
PT-2026-8041
Name of the Vulnerable Software and Affected Versions Known versions prior to 1.6.3 Known version 1.6.2 Description A critical broken authentication issue exists in Known. The application reveals the password reset token within a hidden HTML input field on the password reset page. This allows an...
CVE-2025-69619
A path traversal in My Text Editor v1.6.2 allows attackers to cause a Denial of Service DoS via writing files to the internal storage...
CVE-2025-69619
A path traversal in My Text Editor v1.6.2 allows attackers to cause a Denial of Service DoS via writing files to the internal storage...
CVE-2025-69619
A path traversal in My Text Editor v1.6.2 allows attackers to cause a Denial of Service DoS via writing files to the internal storage...
zipperapp My Text Editor 安全漏洞
Zipperapp My Text Editor is an Android text editor developed by the South Korean company zipperapp. Version 1.6.2 of Zipperapp My Text Editor contains a security vulnerability caused by path traversal attacks. Attackers can exploit this vulnerability by writing files to internal storage, leading ...