CVE-2026-17505

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...

WordPress Participants Database plugin < 2.7.8.4 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by João Ramos Maciel in WordPress Plugin Participants Database versions 2.7.8.4...

CVE-2026-11977 WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

CVE-2026-11969

The vulnerability (CVE-2026-11969) affects the WordPress plugin WP TripAdvisor Review Slider up to version 14.3 . The issue is a SQL Injection via the 'curselrevs[]' parameter caused by insufficient escaping and inadequate preparation of the SQL query. Attack feasibility requires authenticated ac...

WordPress Kali Forms — Contact Form & Drag-and-Drop Builder plugin <= 2.4.20 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Wordfence PRISM in WordPress Plugin Kali Forms versions = 2.4.20...

CVE-2026-68078

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version...

CVE-2026-7441 Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

CVE-2026-7441

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

CVE-2026-7444 Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

CVE-2026-7693

CVE-2026-7693 affects the WordPress Backup Migration plugin up to version 2.1.5.1. The vulnerability is OS Command Injection via the restoreBackup() AJAX handler, where the file POST parameter is sanitized with esc_attr() (HTML-context) and then concatenated unquoted into a php-cli -f … bmi_resto...

CVE-2026-17505 TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...

CVE-2026-17532

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

CVE-2026-16143

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-16143 VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

Photon OS 5.0: Openssh PHSA-2024-5.0-91-0188

An update of the openssh package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0188. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CSRF vulnerability in jenkins-multijob-plugin allows arbitrary code execution

jenkins-multijob-plugin 669.v9d96ad9c71b0 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to execute arbitrary code in the context of the Jenkins controller JVM...

CVE-2026-46334

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing t...

CVE-2026-70594

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted...

XSS in Ghost's ActivityPub client

Impact The ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. Vulnerable Versions This vulnerability is present in the @tryghost/activitypub package up to v3.0.8. All prior versions are also affected. Patches...

GHSA-7MPP-R37J-X5WH Ghost: Session Fixation in Ghost Admin

Impact Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. Vulnerable versions This vulnerability is present in Ghost fro...