Threat database

A Reflected Cross-site Scripting (XSS) vulnerability exists in VikRentCar through version 1.4.7. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute malicious scripts in users' browsers. The vulnerability has a high severity rating with a CVSS score of 7.1.

Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.

Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.

CVE-2026-39785 is a critical SQL Injection vulnerability in Serhii Pasyuk's Gmedia Photo Gallery affecting versions up to 1.25.1. The flaw allows an attacker to perform Blind SQL Injection due to improper neutralization of special elements in SQL commands. This vulnerability can lead to high confidentiality impact and partial availability impact without requiring user interaction or privileges.

Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.

CVE-2026-39781 is a high-severity reflected cross-site scripting (XSS) vulnerability in Dan Rossiter Document Gallery up to version 5.1.1. It allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in a victim's browser. The vulnerability affects versions from 0 through 5.1.1. No official patch or remediation information is provided in the available data.

Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor &amp; Themes <= 2.1.2 versions.

Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.

Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.

Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.

Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.

Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.

Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.

CVE-2026-39769 is a high-severity authentication bypass vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor plugin. It allows attackers to exploit the password recovery mechanism via an alternate path or channel, bypassing authentication controls. The vulnerability affects versions from the initial release up to 3.1.12 inclusive.

Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.

Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.

Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments &amp; Services <= 1.0.19 versions.

Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1.