2026

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExpor

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://pl

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A

Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.

Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5

Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.

Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.

Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.

Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.

Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.

Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.

Missing Authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-char

Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.

Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualiz

Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.

Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 ve

Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.

Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.

Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.

Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.

Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.

Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allow

Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.

Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.

Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.

Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 ver

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.

Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.

Administrator PHP Object Injection in Complianz <= 7.5.0 versions.

Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.

Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.

Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.

Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro a

Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create

Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploit

Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit al

Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.