#
20 entries
2026-07-31
ID: 598
CVE-2026-16910 - Quay: ssrf in red hat quay notification webhooks (slack/generic)
2026-07-31
ID: 597
CVE-2026-15665 - Fluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute
2026-07-31
ID: 596
CVE-2026-15333 - Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute
2026-07-31
ID: 595
CVE-2026-15755 - Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
2026-07-31
ID: 594
CVE-2026-15334 - Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
2026-07-31
ID: 593
CVE-2026-15648 - Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
2026-07-31
ID: 592
CVE-2026-12654 - Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret
2026-07-31
ID: 591
CVE-2026-15653 - Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter
2026-07-31
ID: 590
CVE-2026-15464 - WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
2026-07-31
ID: 587
CVE-2026-12688 - ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery
2026-07-31
ID: 584
CVE-2026-12877 - Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter
2026-07-31
ID: 574
CVE-2026-15100 - Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute
2026-07-31
ID: 573
CVE-2026-6454 - Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute
2026-07-31
ID: 571
CVE-2026-15420 - Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter
2026-07-31
ID: 570
CVE-2025-9205 - MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting