CVE Feed

Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.

Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.

Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-3985.

Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.

Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.

Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.

Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.

Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.

Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.

Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.

Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.

Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.

Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.

Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.

Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.

Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.

Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.

Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.

Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.

Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.

Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.

Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.

Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.

Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.

Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.

Contributor Privilege Escalation in Forminator <= 1.56.0 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPathWithinRoot guard to read sensitive files such as the JWT signing secret, SSH private keys, API credentials, and environment variables, enabling full authentication bypass by forging session cookies on password-protected deployments.

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages without paying.

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_scene/add_node. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn() without any allowlist, blocklist, or argument validation. The authentication middleware becomes a no-op when UI_PASSWORD is not configured, matching the default Docker deployment, enabling attackers to execute arbitrary OS commands as the application user and retrieve full command output including stdout, stderr, and exit code from the server response.