Threat briefs

An unauthenticated stored DOM-based XSS vulnerability (CVE-2026-95686) in the Opti-Behavior plugin for WordPress allows attackers to inject malicious scripts via a publicly accessible nonce-protected ingest endpoint.

Unauthenticated attackers can exploit insufficient input sanitization in the Hide My WP Ghost plugin to inject persistent malicious scripts into WordPress pages.

The PilotPress WordPress plugin (<= 2.0.43) contains a logic flaw in the update_cc_details() AJAX handler that allows an authenticated attacker to trigger an administrative account takeover.

The NotificationX plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in the name parameter, allowing unauthenticated attackers to execute arbitrary web scripts.

An unauthenticated Stored XSS vulnerability in the Salon Booking System WordPress plugin allows attackers to inject malicious scripts into checkout fields.

The SiteOrigin CSS WordPress plugin contains a stored DOM-based XSS vulnerability via the 'url' parameter, allowing unauthenticated attackers to execute arbitrary web scripts.

The Simply Schedule Appointments WordPress plugin is vulnerable to stored XSS via the 'status' parameter, allowing unauthenticated attackers to execute arbitrary scripts in an administrator's browser session.

An unauthenticated stored XSS vulnerability in Ultra Addons for Contact Form 7 (<= 3.5.54) allows attackers to bypass file extension filters and execute arbitrary JavaScript.

The User Profile Builder plugin for WordPress is vulnerable to unauthenticated stored XSS in the 'First Name' field when Email Confirmation is enabled, allowing script injection into user profiles.

The Nexter Extension plugin for WordPress is vulnerable to privilege escalation (CVE-2026-111114) allowing authenticated users to restore elevated roles due to improper state cleanup during bulk demotions.

An authorization bypass vulnerability in the Klarna for WooCommerce plugin allows unauthenticated attackers to enumerate store orders and exfiltrate customer PII via the order-pay endpoint.

An arbitrary file upload vulnerability in the Mang Board plugin for WordPress allows unauthenticated attackers to achieve remote code execution by bypassing extension validation.

The InstaWP Connect plugin for WordPress, versions 0.1.4.1 and earlier, contains a privilege escalation vulnerability allowing authenticated users to extract the master API key and mint administrator session tokens.

The Groundhogg WordPress plugin contains an arbitrary file deletion vulnerability in the copy_file function that allows authenticated users with specific capabilities to remove critical server files.

The Modula Image Gallery plugin for WordPress is vulnerable to unauthenticated information exposure via the REST API, allowing attackers to retrieve plaintext credentials for password-protected galleries.

An authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress allows unauthenticated attackers to hijack user sessions.

The FluentCart plugin for WordPress up to version 1.7.0 contains an IDOR vulnerability allowing unauthenticated attackers to exfiltrate customer billing and shipping PII via sequential ID enumeration.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable to unauthenticated arbitrary file upload in the initMailPart function, potentially leading to remote code execution.

The MailOptin WordPress plugin contains a vulnerability in the subscribe_to_email_list endpoint that allows unauthenticated attackers to overwrite arbitrary user accounts, including administrators, via insecure parameter handling.

The My Calendar WordPress plugin is vulnerable to unauthenticated privilege escalation via a reflected GET parameter that triggers arbitrary function calls, allowing attackers to overwrite administrator credentials.

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (<= 7.5.5) is vulnerable to Stored XSS due to improper input sanitization, allowing unauthenticated attackers to execute arbitrary scripts via comment content.

The Backuply plugin for WordPress is vulnerable to second-order SQL injection, allowing authenticated attackers to achieve privilege escalation through malicious backup restoration.

An unauthenticated stored XSS vulnerability in the Flying Scripts WordPress plugin (CVE-2026-109990) allows attackers to execute arbitrary JavaScript by bypassing core sanitization through an output-buffer rewriter.

The RSS Aggregator by Feedzy WordPress plugin is vulnerable to Stored Cross-Site Scripting via malicious RSS feed input, allowing unauthenticated attackers to execute arbitrary scripts in the context of the target site.

An unauthenticated stored XSS vulnerability in the Colibri Page Builder plugin for WordPress allows attackers to inject malicious scripts via the comment parameter that execute in the context of user browsers.

An unauthenticated attacker can access restricted configuration pages in Customer Managed ShareFile Storage Zones Controller (SZC), leading to system configuration changes and potential remote code execution.

An authenticated user with the Monitor role in WildFly can exploit a path traversal vulnerability in the take-snapshot operation to perform unauthorized reads of sensitive configuration files.

A local improper authorization vulnerability in Lenovo Baiying PC Client allows an authenticated user to achieve privilege escalation through arbitrary code execution.

A vulnerability in the Lenovo Legion Zone application allows an attacker on the same logical network to execute arbitrary code on the host system.

A Server-Side Request Forgery (SSRF) vulnerability in the bitcoinj Payment Request Handler component allows remote attackers to perform unauthorized requests via manipulation of the pki_type argument.