Cryptocurrency Widgets Pack <= 1.8.1 - SQL Injection

Cryptocurrency Widgets Pack Plugin =1.8.1 for WordPress contains an unauthenticated SQL injection caused by unsanitized user input in database queries, letting attackers execute arbitrary SQL commands, exploit requires no authentication. id: CVE-2022-44588 info: name: Cryptocurrency Widgets Pack ...

termshark

Termshark A terminal user-interface for tshark, inspired by Wireshark. V2.4 is out now with packet search and profiles for colors and columns! See theChangeLog. If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help! Features Rea...

CVE-2026-116615

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the postcontent parameter. This is due to asymmetric parsing between the save-time strip filter...

EUVD-2026-124976

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the postcontent parameter. This is due to asymmetric parsing between the save-time strip filter...

CVE-2026-125711

The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets for Airbnb Reviews WordPress plugin...

EUVD-2026-124852

The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets for Airbnb Reviews WordPress plugin...

vBulletin 5.5.4 - 5.6.2- Remote Command Execution

vBulletin versions 5.5.4 through 5.6.2 allow remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. id: CVE-2020-17496 info: name: vBulletin 5.5.4 - 5.6.2- Remote Comman...

PT-2026-146425

The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets for Airbnb Reviews WordPress plugin...

CVE-2026-126747

This module adds large file, multiple file, and resumable uploads to the File and Image field widgets. The module doesn't sufficiently check access to resumable upload forms. This allows an unauthenticated user to start uploads against forms they are not permitted to use, and to store partial...

DRUPAL-CONTRIB-2026-338

This module adds large file, multiple file, and resumable uploads to the File and Image field widgets. The module doesn't sufficiently check access to resumable upload forms. This allows an unauthenticated user to start uploads against forms they are not permitted to use, and to store partial...

EUVD-2026-123169

The Dynific Addons for Elementor formerly Anywhere Elementor WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as...

PT-2026-145662

This module adds large file, multiple file, and resumable uploads to the File and Image field widgets. The module doesn't sufficiently check access to resumable upload forms. This allows an unauthenticated user to start uploads against forms they are not permitted to use, and to store partial...

CVE-2026-117521: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a…

The Dynific Addons for Elementor formerly Anywhere Elementor WordPress plugin before 1.3.1 does not escape a user-controlled profile value before outputting it in a quoted attribute in one of its Elementor widgets, allowing authenticated users with the Author role to store a payload that executes...

CVE-2026-125341

Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue interpolates the result of ImageResizer::filterGetUrl into a single-quoted image source attribute without escaping it. In a third-party plugin that...

CVE-2026-125341

Winter CMS versions 1.1.0 through 1.2.13 are vulnerable to a Stored XSS vulnerability in the Backend iejsze묝ists::evalImageTypeValue() function. The root cause is the interpolation of results from ImageResizer::filterGetUrl() into a single-quoted src attribute without proper escaping. If a third-...

CVE-2026-125341

Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue interpolates the result of ImageResizer::filterGetUrl into a single-quoted image source attribute without escaping it. In a third-party plugin that...

EUVD-2026-122901

Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue interpolates the result of ImageResizer::filterGetUrl into a single-quoted image source attribute without escaping it. In a third-party plugin that...

CVE-2026-121579

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Stored XSS.This issue affects Unlimited Elements For Elementor Free...

EUVD-2026-119245

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Stored XSS.This issue affects Unlimited Elements For Elementor Free...

CVE-2026-121579 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Stored XSS.This issue affects Unlimited Elements For Elementor Free...