2026

Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES all

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. A

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs

Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz A

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / Stell

Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlid

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.

Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.

Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngi

Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.

Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; C

Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.

Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.

Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.

Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.

Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.

Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.

Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.

Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.

Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.

Unauthenticated Broken Access Control in Bookly <= 28.2 versions.

Author SQL Injection in WP ERP <= 1.17.9 versions.

Administrator SQL Injection in Estatik <= 4.3.5 versions.

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacke

Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.

Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.