Threat database

The Testimonials Widget WordPress plugin up to version 4.0.4 has a missing authorization vulnerability. This flaw allows unauthenticated users to submit or modify testimonials via the front-end form without proper capability or ownership checks. Attackers can create or overwrite posts, including changing titles, content, and authorship.

CVE-2026-96531 is a cross-site scripting (XSS) vulnerability in the Optimole WordPress plugin versions 4.0.0 through 4.2.12. It occurs because the plugin does not properly escape unrecognized attributes in its video-player block, allowing users with Author role or higher to inject event-handler attributes that execute scripts in the browsers of users who view the affected post.

WP Delicious WordPress plugin versions prior to 1.10.8 contain a cross-site scripting (XSS) vulnerability. This occurs because the plugin does not properly validate or escape HTML tag names from user-supplied recipe block data before rendering on the front end. Users with Contributor role or higher can exploit this to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.

CVE-2026-85081 is a high-severity Cross-Site Scripting (XSS) vulnerability affecting multiple WordPress plugins that use the file-manager library. Versions of File Manager before 8.0.5, FileOrganizer before 1.2.1, and File Manager Pro before 2.1.3 do not properly validate the origin of window messages in their admin file browser, allowing an unauthenticated attacker to execute arbitrary JavaScript in the context of a logged-in administrator. The vulnerability exists in all versions of the bundled file-manager library prior to 2.1.70. Updating the bundled library to 2.1.70 or later mitigates the issue.

A SQL injection vulnerability exists in the wp-review-slider-pro WordPress plugin versions before 12.7.12. The flaw arises because an AJAX handler does not sanitize input and lacks a capability check, allowing any authenticated user, including low-privileged roles like subscribers, to inject SQL commands. The results of these injections can be returned to unauthenticated visitors. This vulnerability has a CVSS score of 6.5, indicating a medium severity risk.

A stored cross-site scripting (XSS) vulnerability exists in the wp-review-slider-pro WordPress plugin before version 12.7.12. The plugin's AJAX handler that saves review submission forms lacks proper capability checks and uses a nonce generated for every visitor, allowing any authenticated user, including subscribers, to overwrite live forms with malicious field values. These values are output without escaping on public pages, leading to stored XSS.

A stored Cross-Site Scripting (XSS) vulnerability exists in the wp-review-slider-pro WordPress plugin before version 12.7.12. The plugin fails to perform a capability check on one of its AJAX handlers, and the nonce protecting this handler is generated for every visitor, allowing any authenticated user, including low-privileged roles like subscribers, to inject arbitrary review content. This malicious content is then output without proper escaping on public pages, leading to stored XSS.

The File Manager WordPress plugin versions from 7.2.2 up to but not including 8.0.5 contain an information exposure vulnerability. Unauthenticated users can download database backup archives, which may be stored under a fixed filename. This can lead to exposure of sensitive data such as user email addresses and password hashes on servers that do not enforce .htaccess protections for the directory.

A stored Cross-Site Scripting (XSS) vulnerability exists in the WP Directory Kit WordPress plugin versions before 1.5.8. The plugin fails to properly sanitize and escape certain category and location fields before outputting them in page attributes. This allows users with a specific listing-management role, even without the unfiltered_html capability, to inject malicious scripts that execute for any visitor of the affected page.

The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.

CVE-2026-89237 is a SQL Injection vulnerability in the Bluff Post WordPress plugin up to version 1.1.1. The plugin fails to properly sanitize and escape parameters used as SQL identifiers, allowing unauthenticated attackers to append malicious SQL code and extract sensitive database information. The vulnerability has a medium severity with a CVSS score of 6.8.

OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host confidentiality, integrity, and availability.

OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In deployments with the Google Meet plugin enabled, a paired Chrome node, and the googlemeet.chrome node command allowed, a tool-enabled agent able to invoke that command can execute attacker-selected processes on the paired node, impacting files, credentials, browser profiles, and availability on that node. The issue is fixed in 2026.7.1; as a workaround, remove googlemeet.chrome from allowed node commands or disable the Google Meet plugin.

OpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safety check, if the path is changed concurrently. An attacker able to win the race can cause a sandboxed operation to delete, create, or rename a host path outside the intended mirror root with the permissions of the OpenClaw process user. This does not require an operator to have granted host filesystem access outside the sandbox. The issue is fixed in 2026.7.1.

OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel senders to access owner-only host diagnostic bundles. Attackers can request and receive diagnostic details about the host, configuration, runtime, and connected services intended only for owners.

OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documented owner-only requirement for persistent `/activation` policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond more broadly in the group (exposing its responses to additional group traffic) or suppressing expected activation behavior until an owner restores the intended setting. The issue is fixed in version 2026.7.1.

OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model messages, tool schemas, runtime events, and local path metadata from affected sessions by exploiting insufficient authorization checks.

OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and a pending approval are present in the same conversation. As a result, an approver's reaction to unrelated text could be interpreted as approving or denying a pending host action; the practical impact depends on the pending request, conversation timing, and the actions available to the OpenClaw process. The issue does not change the authority of correctly identified approvers. This is fixed in version 2026.7.1.

OpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable the Gateway's Memory Core dreaming behavior, disabling background memory processing or re-enabling durable memory promotion where the owner expected it to remain disabled; the practical confidentiality, integrity, and availability impact depends on stored conversation material and subsequent memory use. Read-only status and help commands remain governed by normal command policy. The issue is fixed in version 2026.7.1. As a workaround, disable dreaming commands in external channels or restrict channel command access to owners.

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the Activity Log settings page.