Threat database

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.

CVE-2026-97283 is a critical deserialization of untrusted data vulnerability in Liquid Web / StellarWP Advanced Post Manager. It allows object injection, potentially leading to full system compromise. The issue affects all versions from initial release up to 4.5.5 inclusive. The vulnerability has a high CVSS score of 9.8, indicating critical impact on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the input data. No known exploits are reported in the wild.

CVE-2026-97275 is a medium severity vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder. It involves improper validation of specified quantity in input, allowing input data manipulation. The issue affects versions from initial releases up to 1.0.28 inclusive. There is no indication of confidentiality or availability impact, but integrity may be affected due to input manipulation. No official patch or remediation information is provided in the source data.

CVE-2026-97309 is a Missing Authorization vulnerability in Webful Creations RepairBuddy, a computer repair shop management software. This flaw allows unauthorized retrieval of embedded sensitive data. The vulnerability affects versions from initial releases up to 4.1226. It has a high severity score of 7.1 under CVSS 4.0. No patch or official remediation information is provided in the available data.

CVE-2026-97070 is an authorization bypass vulnerability in CozyThemes Cozy Blocks cozy-addons. It arises from incorrectly configured access control security levels, allowing unauthorized actions via a user-controlled key. The issue affects Cozy Blocks versions from initial releases up to 2.2.23. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.9. No known exploits are reported in the wild, and no official patch or vendor advisory is currently available.

CVE-2026-97305 is an authorization bypass vulnerability in the Themeisle AI Chatbot for WordPress – Hyve Lite plugin. It allows attackers to exploit incorrectly configured access control security levels via a user-controlled key. This affects versions from initial releases up to 2.0.2. The vulnerability has a medium severity with a CVSS 4.0 score of 6.9.

CVE-2026-103334 is a vulnerability in Etoile Web Design Incorporated's Five Star Restaurant Reservations software that allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. It affects versions from initial releases up to 2.7.24. The vulnerability has a high severity with a CVSS score of 7.5, indicating network exploitable impact with no privileges or user interaction required, and results in high confidentiality impact without affecting integrity or availability.

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.

CVE-2026-100515 is a reflected cross-site scripting (XSS) vulnerability in VillaTheme Photo Reviews for WooCommerce. It affects versions from initial release up to 1.2.30. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in users' browsers. The CVSS score is 7.1, indicating a high severity level. No official patch or vendor advisory is provided in the input data.

CVE-2026-103086 is a missing authorization vulnerability in the Stiofan UsersWP plugin, affecting versions from initial releases up to 1.2.75. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 6.5. No official patch or remediation details are provided in the available data.

CVE-2026-100509 is a stored cross-site scripting (XSS) vulnerability in Webful Creations RepairBuddy, a computer repair shop management software. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. It affects versions from the initial release up to, but not including, 4.1227. The CVSS 3.1 score is 6.5, indicating a medium severity level. There is no information about available patches or vendor advisories. No known exploits are reported in the wild.

CVE-2026-102383 is a missing authorization vulnerability in VillaTheme Lookzy (woo-lookbook) that affects versions from initial release up to 1.1.14. The flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to integrity and availability impacts. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-105637 is a critical authorization bypass vulnerability in the open-source project management tool Plane prior to version 1.4.0. The flaw allows a workspace Guest to manipulate asset UUIDs from other projects within the same workspace and reassign ownership-related fields, leading to unauthorized access to presigned download URLs for files. This issue is fixed in Plane version 1.4.0.

CVE-2026-105636 is a critical Server-Side Request Forgery (SSRF) vulnerability in the open-source project management tool Plane prior to version 1.4.0. The vulnerability arises because the webhook delivery task follows HTTP redirects without validating the final redirect target URL. Although the original webhook URL is checked to block private and reserved addresses, the redirected URL is not validated. This allows an attacker who can create a workspace to register a webhook that redirects to internal addresses, enabling the Plane worker to access internal resources such as cloud metadata. The response from these internal requests is stored in webhook logs, which the attacker can then retrieve via the webhook-logs API. This issue is fixed in Plane version 1.4.0.

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The corresponding POST endpoint checks only whether the submitted email matches project_invite.email and does not validate the invitation token. An attacker who knows the invitation UUID can discover the invited email, register an account with that email, and accept the invitation without receiving the original invite. This issue is fixed in 1.4.0.

CVE-2026-105634 is a privilege management vulnerability in the open-source project management tool Plane. Versions prior to 1.3.0 allow any project member, including those with the lowest GUEST role, to modify other project members' roles. Although the system prevents assigning roles higher than the requester's, it does not prevent assigning equal or lower roles, enabling a Guest user to demote Administrators and Members, potentially disrupting project control. This issue is fixed in version 1.3.0.

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query. A project member can use an issue_id they control in the URL while targeting another user's attachment by its pk UUID. Because the server matches only pk, workspace, and project_id, it modifies the attachment regardless of the issue_id in the URL. When the attachment is pending and has not been confirmed as uploaded, the PATCH handler sets created_by = request.user and transfers attachment ownership to the attacker. This issue is fixed in 1.4.0.

Plane, an open-source project management tool, has an improper access control vulnerability in versions prior to 1.4.0. The GraphQL joinProject mutation allows any workspace member to add themselves to any project within that workspace, including secret/private projects, without proper project-level permission checks. This grants unauthorized full Member role access to confidential projects. The issue is fixed in version 1.4.0.

Plane, an open-source project management tool, has an authorization bypass vulnerability prior to version 1.4.0. This flaw allows workspace members or unauthenticated callers who know specific asset UUIDs and anchors to access private project assets without proper membership verification. The issue is resolved in version 1.4.0.

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0.