Threat briefs

OpenRefine versions up to 3.10.1 are vulnerable to a cross-site request forgery attack in the get-rows command that permits remote attackers to execute arbitrary Jython facet expressions and achieve system command execution.

SkillHub versions prior to 0.2.22 contain an incorrect authorization vulnerability allowing authenticated attackers to perform account takeovers by exploiting the account merge flow.

The MAX platform adapter in cc-connect version 1.5.0 and earlier allows unauthenticated attackers to forge webhook updates and execute arbitrary shell commands on the host system.

AstronRPA versions 1.1.6 and earlier contain a cross-site scripting vulnerability in the smart-component chat that allows remote attackers to trigger arbitrary OS command execution by injecting malicious prompt content.

Spotweb versions 1.5.8 and earlier are vulnerable to remote code execution through the NZB handler, triggered by maliciously crafted Usenet spot titles.

FusionPBX versions up to 5.6.5 contain an unauthenticated OS command injection vulnerability in the call_recordings::download function, allowing arbitrary code execution via crafted Caller-ID fields.

The itsourcecode Leave Management System version 1.0 contains a SQL injection vulnerability in the leave module, allowing remote authenticated attackers to manipulate database queries via the LEAVEID parameter.

The HivePress WordPress plugin for versions 1.7.31 and below contains a stored Cross-Site Scripting (XSS) vulnerability that allows unauthenticated attackers to execute arbitrary scripts in the context of user profiles.

An unauthenticated SQL injection vulnerability in the LatePoint Appointment Booking Plugin allows remote attackers to extract sensitive database information via the booking[service_id] parameter.

An unauthenticated stored XSS vulnerability in WP Photo Album Plus <= 9.3.03.002 allows attackers to inject malicious scripts via REQUEST_URI session history due to insecure output rendering.

An unauthenticated IDOR vulnerability in the WebToffee WooCommerce PDF Invoices plugin allows attackers to retrieve sensitive customer order documents by supplying a known email address.

An authentication bypass vulnerability in the WPO365 Login plugin allows unauthenticated attackers to hijack user sessions by replaying previously issued OIDC tokens.

The Molongui Authorship plugin is vulnerable to unauthenticated Stored DOM-based XSS via unsanitized href attributes in comment content, enabling arbitrary script execution in victim browsers.

The WPAdverts plugin for WordPress contains a stored XSS vulnerability (CVE-2026-100178) that allows unauthenticated attackers to inject malicious scripts via the 'adverts_location' parameter.

The FunnelKit Funnel Builder for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the shipping_first_name parameter due to insufficient input sanitization.

An authentication bypass vulnerability (CVE-2026-104803) in the WPCOM Member WordPress plugin allows unauthenticated attackers to hijack user sessions, including administrative accounts, by exploiting insufficient nonce and session validation in the social-login callback handler.

The Post Grid Gutenberg Blocks - PostX WordPress plugin (<= 5.1.0) is vulnerable to stored Cross-Site Scripting via the display_name field due to insufficient sanitization of double-quotes.

The WP Meteor Website Speed Optimization Addon for WordPress versions 3.4.18 and earlier contains a Stored XSS vulnerability allowing unauthenticated attackers to inject malicious scripts via the comment author name field.

An unauthenticated stored XSS vulnerability in the Quiz and Survey Master plugin allows attackers to inject arbitrary web scripts by triggering a database error in the audit trail logging mechanism.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress up to version 1.8.15 contains a Stored XSS vulnerability in the 'attachments[name]' parameter that allows unauthenticated attackers to inject malicious scripts.

An authorization bypass vulnerability in WP File Download allows authenticated users with subscriber-level access to delete or manipulate managed files.

The Bookly plugin for WordPress contains a PHP Object Injection vulnerability in versions 28.2 and earlier, allowing authenticated users with custom-level access to inject arbitrary PHP objects.

The 10Web Booster WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the author parameter in versions up to 2.34.8.

The LazyLoad Plugin for WordPress up to version 2.4.0 is vulnerable to Stored Cross-Site Scripting (XSS) due to improper sanitization of the comment_content parameter, allowing attackers to inject malicious scripts that execute upon administrator approval.

The Photo Reviews for WooCommerce plugin for WordPress contains a Stored DOM-Based XSS vulnerability (CVE-2026-100161) allowing unauthenticated attackers to inject malicious scripts into product reviews.

The Presto Player WordPress plugin is vulnerable to Stored Cross-Site Scripting via the presto-player tag, allowing unauthenticated attackers to execute arbitrary web scripts.

The Real Estate Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization of the first_name parameter, allowing unauthenticated attackers to bypass reCAPTCHA and execute arbitrary scripts.

The Podlove Podcast Publisher plugin for WordPress contains an unauthenticated Stored XSS vulnerability in the Auphonic Webhook implementation, allowing for arbitrary script injection via crafted POST requests.

The Groundhogg WordPress plugin is vulnerable to unauthorized privilege escalation due to insufficient validation of support user account credentials within the create_support_user() function.

The FV Player 8 WordPress plugin is vulnerable to arbitrary file upload via the check_mimetype function, allowing authenticated subscribers to execute remote code via race condition exploitation.