CVE-2026-57718: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor Free...

CVE-2026-11591

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level...

CVE-2026-11591

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level...

CVE-2026-11591 Widgets for Google Reviews <= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level...

CVE-2026-11591: Improper Neutralization of Input During Web Page Generation

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level...

CVE-2026-55880 OpenReplay: Cross-user IDOR in notes and dashboard widgets

OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.updatewidget an...

CVE-2026-55880

OpenReplay CVE-2026-55880 affects OpenReplay self-hosted session replay (versions 1.27.0 and earlier). The root cause is that three mutation operations—notes.delete, dashboards.update_widget, and dashboards.remove_widget—executed SQL without the ownership predicate used by their read/edit sibling...

WordPress Widgets for Google Reviews plugin <= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability

Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by coih in WordPress Plugin Widgets for Google Reviews versions = 13.3...

CVE-2026-15299: Improper Neutralization of Input During Web Page Generation

The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weatherstyle' and 'movedirection' parameters of the Weather widget in all versions up to, and including, 2.6.3. This is due to insufficient output escaping in the Weather widget's render...

CVE-2026-6459: Improper Neutralization of Input During Web Page Generation

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on event titles sourced...

astropixie-widgets (0.1.3) potentially affected by CVE-2023-41334 via astropy (3.0.1)

astropy PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on astropy and may be impacted: - astropixie-widgets 0.1.3 Source cves: CVE-2023-41334 Source advisory: OSV:PYSEC-2026-1199...

astropixie (>=0.1.4, <=0.1.8), astropixie-hr (0.1.0) +1 more potentially affected by CVE-2023-41334 via astropy (3.0.5)

astropy PYPI version 3.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on astropy and may be impacted: - astropixie =0.1.4, =0.1.4, =0.1.8 Source cves: CVE-2023-41334 Source advisory: OSV:PYSEC-2026-1199...

astropixie-widgets (>=0.1.0, <=0.1.2), autolens (0.1.2) +1 more potentially affected by CVE-2023-41334 via astropy (3.0.0)

astropy PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on astropy and may be impacted: - astropixie-widgets =0.1.0, =0.1.2 - autolens 0.1.2 - moons1d 0.2.4 Source cves: CVE-2023-41334 Source advisory: OSV:PYSEC-2026-1199...

CVE-2026-12154

The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pageid' shortcode attribute of the fbrev shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-12154

The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pageid' shortcode attribute of the fbrev shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the...

EUVD-2026-41894

The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pageid' shortcode attribute of the fbrev shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-12154

The CVE concerns the WordPress plugin Reviews Widgets for Google, Yelp & TripAdvisor (fb-reviews-widget)

CVE-2026-12154: Improper Neutralization of Input During Web Page Generation

The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pageid' shortcode attribute of the fbrev shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the...

Essity: Unauthenticated Plugin Settings Modification on Three Crocoblock/Jet Plugins

The vulnerability summary is as follows: Three Crocoblock Jet plugins were found to expose REST API endpoints that allowed unauthenticated users to modify plugin settings via POST requests without any authentication or authorization checks. The endpoints validated and parsed the POST body, then...

aiidalab (>=22.6.0, <=26.9.0), aiidalab-dlpoly (>=0.1.0, <=0.2.0) +111 more potentially affected by CVE-2026-52726 via dulwich (>=0.23.2, <=1.2.1)

dulwich PYPI version =0.23.2, =22.6.0, =0.1.0, =0.1.0, =1.3.4, =0.12.0, =0.1.0, =0.2.0, =0.2.0, =0.2.1, =0.2.1, =0.3.0, =0.8.3, =0.1.0, =0.1.6 and more Source cves: CVE-2026-52726 Source advisory: GHSA-GFHV-VQV2-4544...