EUVD-2026-1735

The WP Page Permalink Extension plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.4. This is due to missing authorization checks on the cwpptriggerflushrewriterules function hooked to wpajaxcwpptriggerflushrewriterules. This makes it possible fo...

EUVD-2026-1743

The Lesson Plan Book plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' variable in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

OESA-2026-1046 gnutls security update

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, and other...

CVE-2025-64090

creationtimestamp| type| source ---|---|--- 2026-01-09 11:04:13+00:00| seen| Telegram/hGok3FHgWgbXq-4QwRuv2kdh52nqy5VuUREmY2DmSo70XhI 2026-01-09 11:58:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbygzgd2dg2q 2026-01-09 14:14:29+00:00| seen|...

EUVD-2026-1756

Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device...

CVE-2023-25798

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Olevmedia Olevmedia Shortcodes plugin = 1.1.9 versions...

EUVD-2026-1769

The Entry Views plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'entry-views' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-14886

creationtimestamp| type| source ---|---|--- 2026-01-09 09:12:06+00:00| seen| https://gist.github.com/Darkcrai86/b1056ce914d9710eab22fbfe43b334e4...

CVE-2026-20973

creationtimestamp| type| source ---|---|--- 2026-01-09 08:40:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mby3xhsfn62u...

CVE-2025-14657

creationtimestamp| type| source ---|---|--- 2026-01-09 08:38:20+00:00| seen| https://gist.github.com/Darkcrai86/b721e54658f7af1b4abf5246fc561373 2026-01-09 09:01:39+00:00| seen| Telegram/McZDz-QSSEXJogUpJoqFtqll3QxqzWp4PQCJiRiyMRSDEg 2026-01-09 09:06:09+00:00| seen|...

CVE-2025-15057

creationtimestamp| type| source ---|---|--- 2026-01-09 08:03:00+00:00| seen| Telegram/baYAHbqMqSalDW7Jh5vLcnZYQr2csVL8CwQNknT-bM3nPo8 2026-01-09 08:41:55+00:00| seen| https://gist.github.com/Darkcrai86/3514d22fb35676a07c991248d6731f3a...

EUVD-2026-1781

A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially...

EUVD-2026-1775

The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postsettings' function in all versions up to, and including, 4.0.51. This makes it possible for...

EUVD-2026-1779

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including, 3.9.3. This is due to a missing capability check and purchasability validation in the courseenrollment AJAX handler. This makes it possib...

EUVD-2026-1787

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability check on the 'bulkactionhandler' and 'couponpermanentdelete' functions in all versions up to, and including, 3.9.3. This makes it...

EUVD-2026-1785

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' and 'resource' parameters in all versions up to, and including, 5.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-1803

The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

EUVD-2026-1794

The WP Google Street View with 360° virtual tour & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpgsvmap' shortcode in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible...

EUVD-2026-1791

The BIALTY - Bulk Image Alt Text Alt tag, Alt Attribute with Yoast SEO + WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bialtycsalt' post meta in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes...

EUVD-2026-1786

The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scripts function. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive data including the OpenAI API...