SQL injection (CWE-89) in the affiliate-toolkit WordPress plugin before 3.8.9: an unvalidated user-supplied sort value on an editor-reachable admin list screen lets editors and above read arbitrary database data; on multisite, a sub-site editor…
CVE-2026-110015 is a CSRF flaw (CWE-352, CVSS 8.8) in the Salon Booking System WordPress plugin before 10.31.9. The plugin discards WordPress core's nonce check for cookie-authenticated REST API requests, letting unauthenticated attackers forge requests…
CVE-2026-94134 is an insecure-by-default flaw in the Apache Airflow SSH provider hook: unless host_key is configured or no_host_key_check is explicitly set to false, SSH and SFTP connections accept any server key, letting a machine-in-the-middle…
Events Made Easy for WordPress (through 3.2.22) allows unauthenticated stored XSS via the event[location_name] parameter, but only when guest submission and forced location creation are both enabled; fixed in 3.2.23, CVSS 5.4.
Missing capability check in The Squeeze WordPress plugin before 1.8.1 lets any authenticated user, including Subscribers, revert any attachment to its backup and permanently delete the backup and generated WebP derivatives, regardless of ownership.…
CVE-2026-110703 is a stored cross-site scripting flaw in the GeoDirectory WordPress plugin (all versions up to and including 2.8.191), exploitable via the post_content parameter by authenticated subscriber-level users who own a published listing; because…
Stored Cross-Site Scripting (CWE-79) in the WP Sessions Time Monitoring Full Automatic WordPress plugin, all versions up to and including 1.1.5, exploitable by unauthenticated attackers via the action, function, plugin, post_type, post_status, ids, loggedout,…
Unauthenticated stored XSS (CVSS 7.2) in the WPConsent cookie-consent WordPress plugin through version 1.1.9, exploiting noise-key restoration in the bundled Simple HTML DOM parser when the Script Blocking feature is enabled; the two-comment chain…
Improper authorization in query resolvers generated by @aws-amplify/graphql-index-transformer (AWS Amplify API Category before 3.1.2) might let an authenticated remote user read records owned by other users of the same application via crafted queries. Fixed…
Stored XSS (CWE-79) in the Tutor LMS WordPress plugin up to and including 4.1.0 via the display_name parameter. Subscriber-level attackers can inject web scripts that execute when users access the injected page; exploitation is…