2026

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoin

The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints

DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote att

The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a S

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-fe

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowin

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allo

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning supp

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership che

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 throug

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it be

The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downlo

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of i

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor re

The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the target

The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rend

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all ver

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a p

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurri

The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by t

The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value af

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before us

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data

The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting us

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing

The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it m

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not i

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument us

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound v

ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_path

ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-control

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_previ

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpo

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-For

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the se

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin r

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscri

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image