CVE-2026-108572 Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from...

CVE-2026-108571 Xinhu Rainrock RockOA Openkqj Action openkqjAction.php returnchuli sql injection

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection. The attack is possible to be carri...

CVE-2026-108570 Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine

A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngine.cs of the component View Engine. The manipulation of the argument content results in improper neutralization of special...

CVE-2026-108569 Furion .NET Framework StringRenderExtensions.cs String.Replace sql injection

A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack ...

CVE-2026-108804

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-108568

The InstantSoft icms2 software (versions up to 2.18.2 ) contains a vulnerability in the Billing Module specifically within the validatePaypalOrder function located in the file system/controllers/billing/actions/paypal.php. An attacker can remotely manipulate the bid/sig arguments to cause insuffi...

CVE-2026-108567

A path traversal vulnerability exists in InstantSoft icms2 (up to version 2.18.2) within the Image Handler component. Specifically, the files_delete_file function in the file system/fields/image.php file is susceptible to exploitation through manipulation of the argument size. This flaw can be tr...

CVE-2026-108566

A cross-site scripting (XSS) vulnerability exists in InstantSoft icms2 versions up to 2.18.2 . The flaw is located in the index function of the templates/default/controllers/messages/index.tpl.php file within the Private Message Handler component. Improper handling of the nickname argument allows...

CVE-2026-108544

A path traversal vulnerability exists in the Lippu Docx Reader Office Viewer App on Android , affecting versions up to 1.4.5 . The flaw is located in the word.office.docxviewer.document.docx.reader.ViewTxt function, where improper handling of the _display_name argument allows for directory traver...

CVE-2026-108543

The ag2ai ag2 library (versions up to 0.13.4 ) is vulnerable to a path traversal vulnerability within the UserProxyAgent component. The root cause is the improper handling of the filename argument in the os.path.join function, which allows for remote execution of the attack. While an exploit has ...

CVE-2026-108542

A server-side request forgery (SSRF) vulnerability exists in the 021is elvix-sdk up to version 0.10.1 . The flaw is located within an unknown functionality of the src/mcp/index.ts file in the MCP Request Handler component. By manipulating the argument path , an attacker can execute the attack rem...

CVE-2026-108541

A SQL injection vulnerability exists in the highwarden Super Store Finder software up to version 3.8 . The flaw resides in an unknown function within the /products/superstorefinder/index.php file, where the manipulation of the lat/lng arguments allows for remote exploitation. To remediate this is...

CVE-2026-93550

The Veeqo for WooCommerce WordPress plugin (versions

CVE-2026-96227

The Piotnet Forms WordPress plugin, version 1.0.30 and below, is vulnerable to an Unauthenticated Stored XSS via file upload. The flaw exists because the plugin fails to authenticate or validate form-submission file-upload requests, allowing unauthenticated attackers to store browser-renderable f...

CVE-2026-91829

The Subscribe to Comments WordPress plugin (versions before 2.3.3 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly validate a parameter before reflecting it into a link target. This allows unauthenticated attackers to execute malicious scripts ag...

CVE-2026-97183

The WP-Invoice WordPress plugin (versions through 4.3.1 ) is vulnerable to User PII Disclosure due to a lack of capability checks in several AJAX handlers . This flaw allows any authenticated user, such as one with Subscriber privileges, to retrieve sensitive information including email addresses...

CVE-2026-89302

The Post Voting System WordPress plugin (version 1.0 and below ) is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitize and escape the 'id' parameter before incorporating it into a SQL query. This allows remote unauthenticated users to execute...

CVE-2026-89299

The WP Verify API WordPress plugin (versions through 1.0.0 ) is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitize and escape a parameter before it is processed in a SQL query . This flaw allows unauthenticated users to perform SQL injection ...

CVE-2026-89304

The Paymendo Bank Transfer WordPress plugin, version 1.1 and below , is vulnerable to unauthenticated blind SQL injection . The root cause is the failure to properly sanitize and escape the 'paymendo_bank_transfer_completed_payment' parameter before utilizing it in a SQL query. This flaw allows r...

CVE-2026-89305

The paymendo Bank Transfer WordPress plugin (version 1.1 and below ) is vulnerable to SQL injection due to insufficient sanitization and escaping of a parameter before it is used in a SQL query. This flaw allows any authenticated user to perform SQL injection attacks against the database. No spec...

CVE-2026-89297

The Loja Automática WordPress plugin (version 1.0.0 and below) is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitize and escape a parameter before its use in a SQL query. This flaw allows unauthenticated users to execute arbitrary SQL command...

CVE-2026-89287

The ASPL Product Quotation WordPress plugin (version 1.1.0 and below) is vulnerable to an unauthenticated SQL injection flaw. The root cause is the failure to properly sanitize and escape the 'quote_id' parameter before using it in SQL statements. This allows an unauthenticated attacker to perfor...

CVE-2026-89232

The Recordbrowser WordPress plugin (version 1.1.7 and below ) is vulnerable to an unauthenticated SQL injection via the 'recordid' parameter . The root cause is the failure to properly sanitise and escape this parameter before utilizing it in a SQL query. An attacker can exploit this to append ad...

CVE-2026-89285

The Datalist it WordPress plugin, affecting versions through 0.0.3 , contains an unauthenticated SQL injection vulnerability. The root cause is the failure to properly sanitize and escape several request parameters before incorporating them into a SQL query. This allows an unauthenticated attacke...

CVE-2026-89214

The WpCues Basic Quiz WordPress plugin, in versions up to and including 1.6.5 , is vulnerable to an unauthenticated SQL injection vulnerability. The flaw exists because the plugin fails to properly sanitize and escape values prior to utilizing them in a SQL statement during the Quiz Result Submis...

CVE-2026-89213

The Llavero.io WordPress plugin, version 0.1.4 and below , is vulnerable to unauthenticated Blind SQL injection . The root cause is the failure to properly sanitize and escape a parameter before its use in a SQL statement. This flaw allows unauthenticated attackers to execute SQL commands and rea...

CVE-2026-89283

The WP Posts Password Batch Manager WordPress plugin (versions through 1.1 ) contains a vulnerability where it fails to perform capability or nonce checks on a bulk post-password action. This action runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite t...

CVE-2026-89234

The WP-Partner WordPress plugin (versions through 1.2.1 ) is vulnerable to an unauthenticated SQL injection via the 'id' parameter . The root cause is the failure to properly sanitize and escape this parameter before including it in a SQL query. This flaw allows an unauthenticated attacker to app...

CVE-2026-88903

The Topcontent WordPress plugin (version 1.2.1 and below ) contains an unauthenticated stored XSS vulnerability. The root cause is improper authorization of a request handler combined with the disabling of HTML sanitisation before storing submitted content. This allows unauthenticated attackers t...

CVE-2026-89195

The Site Setup Wizard WordPress plugin, version 1.5.8 and below , contains an unauthenticated SQL injection vulnerability. The flaw exists because the plugin fails to properly sanitize and escape a parameter used in a SQL statement within the ssw_check_admin_email_exists function. This oversight ...

CVE-2026-88930

The Social Web Suite WordPress plugin, in versions up to and including 4.1.12 , is vulnerable to an unauthenticated Blind SQL injection . The root cause is that the plugin fails to require a shared secret before accepting authorized requests and lacks proper sanitization and escaping of a paramet...

CVE-2026-88827

The Disable Users WordPress plugin (version 1.0.5 and below ) contains an authentication bypass vulnerability. The plugin fails to enforce account-disabling controls across all authentication paths. This allows a user whose account has been disabled by an administrator to continue authenticating ...

CVE-2026-108540

A vulnerability exists in OpenSpug Spug up to versions 3.4.0/4.0.1 within the File Transfer component. The flaw impacts an unknown function of the /exec/transfer file, where improper neutralization of special elements allows for os command injection . This vulnerability can be triggered via a rem...

CVE-2026-88905

The KeyWord Collector WordPress plugin (versions up to and including 1.4 ) is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) and unauthorized settings updates. The root cause is the lack of authorization or nonce checks when saving settings via WPKeyWordSettings , combined with a...

CVE-2026-88826

The SmugMug Embed WordPress plugin (versions through 3.13 ) is vulnerable to Unauthenticated Stored XSS . The root cause is a lack of authorization and CSRF checks on an AJAX action used to store gallery data, combined with a failure to sanitize or escape that data before output. This allows unau...

CVE-2026-88785

The Simple Membership WordPress plugin, in versions prior to 4.8.3 , is vulnerable to sensitive information disclosure. When the optional auto-login-after-registration feature is enabled, the plugin transmits a newly registered member's plaintext password within a URL query string . This exposure...

CVE-2026-87761

The Adwised Web Push Notification WordPress plugin, versions through 2.5.7 , is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to perform capability or nonce checks when allowing authenticated users to overwrite site-wide configurations. Furthermore, it...

CVE-2026-87764

The BuddyPress Instant Chat WordPress plugin (versions through 1.6 ) is vulnerable to unauthenticated stored XSS . The root cause is a failure to verify if a message sender belongs to a specific conversation and a lack of output escaping for message content. This allows unauthenticated users to i...

CVE-2026-87762

The Adwised Web Push Notification WordPress plugin (versions through 2.5.7 ) is vulnerable to unauthenticated stored XSS . The root cause is a lack of authorization checks on state-changing operations combined with a secret key type juggling flaw. This flaw allows an attacker to bypass secret com...

CVE-2026-87760

The Web Vitals Tracking WordPress plugin, affecting versions through 5.4.2 , is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is a failure to validate or escape performance measurements submitted by unauthenticated visitors before these measurements are stored a...

CVE-2026-86706

The Quick quotes WordPress plugin (version 1.0.0 and below ) is vulnerable to an unauthenticated integer-value option update . The root cause is a lack of capability or nonce checks on one of its AJAX actions , which allows an attacker to choose which option is written. This vulnerability enables...

CVE-2026-86798

The HootBoard WordPress plugin, in versions up to and including 3.1.4 , is vulnerable to Unauthenticated Stored XSS . The flaw exists because certain REST endpoints lack proper authorization checks and fail to escape values before displaying them on public pages. This allows unauthenticated attac...

CVE-2026-85126

The Crowdfundly WordPress plugin (versions through 2.2.2 ) is vulnerable to privilege escalation due to a lack of capability checks on specific AJAX actions . An attacker with a low-privileged role within the plugin can exploit this to grant themselves the administrator role or arbitrary capabili...

CVE-2026-86717

The Insurify WordPress plugin (version 1.0 and below ) is vulnerable to unauthenticated arbitrary option deletion. The root cause is a lack of authorisation and nonce checks on a specific AJAX action associated with the removeimg_popup function. An unauthenticated attacker can exploit this to del...

CVE-2026-85121

The Insurify WordPress plugin (version 1.0 and below ) is vulnerable to unauthenticated arbitrary option creation and overwrite via the saveemailtemplatedesign AJAX action. The root cause is a lack of authorisation and nonce checks on this specific action, which allows an attacker to submit reque...

CVE-2026-84260

The click5 CRM add-on to Gravity Forms WordPress plugin, version 1.0.3 and below , is vulnerable to Unauthenticated Stored XSS . The root cause is a failure to sanitise and escape content submitted via an unauthenticated endpoint before it is displayed on an admin page. An attacker could exploit ...

CVE-2026-84261

The click5 CRM add-on to Contact Form 7 WordPress plugin, version 1.0.4 and below, is vulnerable to Unauthenticated Stored XSS . The flaw exists because the plugin fails to properly sanitise and escape content submitted through an unauthenticated endpoint via post_notifications before displaying ...

CVE-2026-84737

The Freeton WP WordPress plugin (version

CVE-2026-85118

The AI Content Generator Marketing WordPress plugin (versions through 1.0.0 ) is vulnerable to unauthenticated privilege escalation . The root cause is a failure to enforce nonce or capability checks on specific AJAX actions, which allows unauthenticated users to update and delete arbitrary WordP...

CVE-2026-84734

The Mindstien Quick Login WordPress plugin (version 1.0 and below ) is vulnerable to an unauthenticated administrator account takeover . The root cause is a failure to correctly validate values supplied in the request against the visitor's own session during the authentication process. Specifical...