Threat briefs

The VikRentCar plugin for WordPress (<= 1.4.8) contains a CSRF vulnerability in the condtext_update_tmpl function that permits unauthenticated attackers to achieve remote code execution by injecting PHP code into template files.

The SureCart WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping.

Multiple vulnerabilities in WordPress versions prior to 7.1.4 allow remote attackers to execute arbitrary code, conduct denial-of-service, perform unauthorized data access, and bypass security policies.

An unauthenticated remote code execution vulnerability in the SimpleForm WordPress plugin (<= 3.10.2) allows attackers to bypass file validation via trailing-dot filenames and exploit publicly exposed nonces.

CVE-2026-100105 is an authorization bypass in Grafana Alerting Contact Points that allows attackers with Editor permissions to redirect alert notifications to unauthorized destinations and exfiltrate credentials through schema version manipulation.

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.6.1 due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts.

A vulnerability in konflux-ci allows local attackers on build runners to retrieve sensitive GitHub access tokens stored in plaintext by CI automation scripts.

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress contains a Stored Cross-Site Scripting vulnerability allowing unauthenticated attackers to inject arbitrary web scripts via the mail subject parameter.

The Rox Appointment Booking plugin for WordPress is vulnerable to unauthenticated mass assignment, allowing attackers to overwrite administrator email addresses and facilitate account takeover.

An authentication bypass vulnerability in the Wp Social Login and Register Social Counter plugin allows unauthenticated attackers to impersonate any site user, including administrators, by spoofing OAuth email callbacks.

The ThirstyAffiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping.

Starlet Perl server versions before 0.33 are vulnerable to memory and CPU exhaustion attacks, alongside response protocol corruption, caused by improper handling of HTTP requests.

Apache MINA versions 3.0.0 through 3.0.0-M2 are vulnerable to remote code execution due to unsafe deserialization in the JavaNativeMessageDecoder class.

The Mail logging & Catcher plugin for WordPress (<= 2.2.0) contains an information exposure vulnerability allowing authenticated users to extract password-reset keys and escalate privileges to administrator.

The FunnelKit Automations plugin for WordPress is vulnerable to time-based SQL injection via the bwfan_cart_id parameter, allowing unauthenticated attackers to extract database information during delayed Action Scheduler job execution.

The Welcart e-Commerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'gid' parameter, allowing unauthenticated attackers to execute arbitrary JavaScript in the administrative dashboard.

The Relevanssi - A Better Search plugin for WordPress (v4.28.5 and earlier) is vulnerable to stored cross-site scripting (XSS) via the comment parameter, allowing unauthenticated attackers to execute arbitrary scripts when specific search-highlighting features are enabled.

The VikRentCar WordPress plugin contains a stored XSS vulnerability in the poplink parameter that is exploitable by unauthenticated attackers due to the public exposure of the vikwp_nonce token.

Bold Grid W3 Total Cache versions from n/a through 2.10.7 contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, which allows Stored XSS.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping.

The PPWP Password Protect Pages plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting via improper input sanitization in shortcode attributes, allowing script injection into pages.

The Ninja Forms WordPress plugin is vulnerable to stored cross-site scripting (XSS) due to improper input sanitization and a flawed nonce implementation in the nf_ajax_submit endpoint, allowing unauthenticated attackers to execute arbitrary web scripts.

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_content parameter, allowing unauthenticated attackers to execute arbitrary JavaScript if specific plugin settings are enabled.

The Popup Builder WordPress plugin contains an authorization bypass vulnerability (CVE-2026-89270) that allows unauthenticated attackers to bulk delete published popups via a crafted GET request.

The WP Booking System - Booking Calendar plugin contains a vulnerability in the wpbs_action_ajax_calendar_remove_note function that allows authenticated users to delete arbitrary calendar notes due to a missing capability check.

An authenticated remote code execution vulnerability in the Mooveagency Import Xml And Rss Feeds WordPress plugin (CVE-2023-4300) allows high-privilege users to upload and execute arbitrary PHP files.

CVE-2026-29057 is an HTTP request smuggling vulnerability in Next.js allowing attackers to smuggle secondary requests to internal backends via chunked transfer-encoding desynchronization.

Crypttech Vatos DLP versions 1.1.176 through 1.1.242 store passwords in plaintext, facilitating unauthorized access to domain credentials.

OAuthLib fails to validate the device_code parameter during device flow token requests, allowing attackers with a valid client ID to illicitly obtain bearer tokens.

The russh library fails to trigger the Agent::confirm callback for SSH keys protected by the confirm constraint, allowing unauthorized signing operations by any process capable of communicating with the agent.