2026

Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Rec

Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Rec

Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Ac

Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retri

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-f

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMa

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Inj

Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled

Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan.

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when pars

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when pars

The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 characte

The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it

The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership chec

The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acti

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its setting

Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly

Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Conf

Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-a

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Aud

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks a

Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Acce

Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allo

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook

In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to s

Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptograph

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pat

Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentica

CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in A

The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds

By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML docume

In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostn

In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max

Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XM

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interacti

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-

Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms ne

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSe

Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalat

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configur

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configur

Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue af

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Conf

Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issu

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple P