Threat database

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.

The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request, including a logged-in administrator.

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.

The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page.

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's download dialogue, including administrators. Only sites running PHP below 8.1 are affected, as the sanitisation applied when the setting is saved does not neutralise single quotes there.

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites where another installed Cache Enabler WordPress plugin before 1.8.17 or passes a request-derived URL to its public cache-clearing hook.

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to delete arbitrary files on the server, leading to sensitive data disclosure and site takeover. The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 has been closed on WordPress.org since July 2024 and no fixed version is available. Remove it from any site where it is installed.

The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF attack.

CVE-2026-103543 is a medium severity SQL injection vulnerability in itsourcecode Leave Management System version 1.0. It occurs due to improper handling of the LEAVTID argument in the /module/leavetype/controller.php file, allowing remote attackers to manipulate SQL queries. The vulnerability has been publicly disclosed, but no official patch or fix information is available.

CVE-2026-80275 is a high-severity vulnerability in Comelit Group S.p.A.'s 1456B Multi-User Gateway firmware versions 2.9.1 and 2.10.0. The issue arises from a lack of server-side authorization enforcement on an administrative password-change function, allowing an authenticated user to overwrite the installer (administrator) account password. This flaw enables privilege escalation within the device.

The Comelit 1456B Multi-User Gateway firmware versions 2.9.1 and 2.10.0 have a vulnerability where the network-accessible management interface does not require authentication. This allows a remote, unauthenticated attacker to read sensitive device configuration data, including the Remote Configuration Password, in cleartext.

CVE-2026-103542 is a server-side request forgery (SSRF) vulnerability in Form Tools up to version 3.1.1. The flaw exists in the smart_fill function within the AJAX Endpoint component, specifically in /global/code/actions.php. This vulnerability allows remote attackers to manipulate the url argument to induce the server to make unintended requests. Exploit code has been published, but no vendor response or patch is currently available.

Threat actors are abusing legitimate ScreenConnect client software by distributing a preconfigured version via phishing emails. The malicious executable is signed by the legitimate vendor ConnectWise, making it appear trustworthy and bypassing basic security controls. This technique leverages existing remote management tools to establish unauthorized remote access.

The Redux Framework WordPress plugin up to version 4.5.14 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can delete arbitrary media library attachments, including those owned by administrators. This occurs because the plugin does not properly verify user authorization when a Custom Fonts field is registered on the user profile page, exposing a nonce that enables this action.