The Data Tables Generator by Supsystic WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the updateRows action that allows authenticated users with subscriber-level access or higher to inject malicious scripts via table cell data. This vulnerability affects all versions up to and including 1.15.1. Exploitation requires that an administrator has explicitly granted the subscriber role access to the plugin's 'access_roles' setting, enabling them to reach the vulnerable action handler. The vulnerability can lead to script execution in the context of users visiting the injected pages.
CVE-2026-108501 is a medium severity vulnerability in the ZTE Z80 Ultra device involving improper privilege management. The system interface lacks necessary permission verification, allowing reflective invocation to read sensitive information without proper access control. This vulnerability does not impact integrity or availability but can lead to unauthorized disclosure of confidential data.
The Extensions For CF7 plugin for WordPress, versions up to and including 3.4.5, contains an arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to upload potentially executable files due to insufficient validation of file extensions, MIME types, and file sizes in the signature field. Additionally, the plugin lacks PHP execution restrictions in the upload directory and has a bypass in sanitize_file_name() that enables malicious file names to be accepted. Exploitation can lead to remote code execution.
CVE-2026-103365 is a medium severity vulnerability in the Bookly Online Scheduling and Appointment Booking System WordPress plugin up to version 28.4. It allows unauthenticated attackers to access sensitive customer information by exploiting an endpoint that improperly validates requests and uses attacker-supplied identifiers to retrieve personal data. This exposure includes customer names, emails, phone numbers, and internal notes when certain placeholders are used in the booking form's Details step.
The Advanced IP Blocker WordPress plugin up to version 8.13.13 contains a critical authentication bypass vulnerability. This flaw allows unauthenticated attackers to bypass two-factor authentication (2FA) by exploiting improper server-side checks and nonce reuse. Attackers can brute-force a 6-digit TOTP code without rate limiting or lockout, gaining full authenticated sessions and potentially complete site takeover. Exploitation requires only knowledge of a valid user ID with 2FA enabled. The vulnerability is tracked as CVE-2026-104732 with a CVSS score of 9.8.
The Blocksy Companion WordPress plugin contains a critical privilege escalation vulnerability in versions up to and including 2.1.58. This flaw allows unauthenticated attackers to bypass Dokan's vendor-registration nonce check and specify arbitrary roles during user registration, enabling them to escalate privileges to a Dokan 'seller' (vendor) account. The vulnerability also automatically authenticates the attacker into the elevated account, granting publishing capabilities beyond those of a normal customer.
The Advanced Form Integration — Connect Forms to 300+ Apps WordPress plugin up to version 2.9.0 contains an authentication bypass vulnerability. This flaw allows unauthenticated attackers to change any WordPress user's password, including administrators, by submitting a specially crafted public Contact Form 7 form. The vulnerability arises because the plugin's function handling the Ultimate Member "Update Profile Field" action does not verify the submitter's identity or permissions before updating sensitive user profile fields such as passwords. Exploitation requires prior configuration of the Contact Form 7 integration with the vulnerable action.
The Table Field Add-on for ACF and SCF WordPress plugin versions up to 1.4.1-RC2 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with subscriber-level access or higher can inject malicious scripts via the Table Field Value. These scripts execute whenever a user views the affected page, potentially compromising user interactions. The vulnerability arises from insufficient input sanitization and output escaping.
The Bookly plugin for WordPress up to version 28.4 contains an authorization bypass vulnerability due to insecure direct object reference via user-controlled parameters. Authenticated users with subscriber-level access or higher can exploit this flaw to overwrite the WordPress account binding of any Bookly staff record, including administrators, leading to privilege escalation. Exploitation requires the attacker to be linked to at least one Bookly staff record, which is enabled by default on fresh installs with a specific option active.
CVE-2026-101947 is a high-severity OS command injection vulnerability in CellHubs ExifTool for photo and video version 5.0.1-gms. The vulnerability arises because the software constructs shell command strings from file paths without properly escaping embedded single quotes, specifically in the CSV-export functionality. This improper neutralization of special elements (CWE-78) allows an attacker to inject arbitrary commands via crafted file paths. The vulnerability requires local access with user interaction and has no known exploits in the wild.
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning WordPress plugin up to version 4.0.3 contains a privilege escalation vulnerability. Authenticated users with the 'academy_guardian' role or higher can exploit improper privilege management to elevate any existing WordPress account to the 'academy_student' role. This role grants additional capabilities such as 'edit_posts' and, if enabled, 'upload_files'. The vulnerability arises because the plugin assigns the 'academy_student' role before validating the guardian-ward relationship and does not revert this assignment if validation fails.
The Advanced Classifieds & Directory Pro WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'phone' parameter in versions up to and including 3.4.4. This vulnerability requires that the 'Force Bootstrap' setting is enabled and the 'ACADP Listing Address' widget is placed on a sidebar on single listing pages, both of which are non-default configurations. Authenticated users with custom-level access or higher can inject malicious scripts that execute when other users view the affected pages.
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning WordPress plugin contains an authorization bypass vulnerability in all versions up to and including 4.0.3. Authenticated users with custom-level access or higher, registered as instructors for at least one course, can exploit this flaw to delete lesson comments and replies authored by any user, including administrators, across courses they do not instruct. This occurs because the plugin fails to properly verify user authorization for the delete action.
The FBI arrested Edward Dubrovsky, co-founder of a Canadian cybersecurity firm specializing in ransomware negotiation, on charges related to assisting the ShinyHunters hacking group. ShinyHunters is known for using phishing and stolen credentials to steal data from software-as-a-service companies and extorting victims by threatening to publish stolen data. Dubrovsky faces charges including conspiracy to threaten confidentiality with intent to extort and interference with commerce by threats. The investigation has centralized in the FBI's Eastern District of Texas, the hub for ShinyHunters-related cases. Dubrovsky authored a book on ransomware negotiation strategies. The case is ongoing with several documents sealed, and further charges against other ransomware negotiation firms may follow.
A security update for Chromium version 155.0.8059.39 addresses multiple vulnerabilities including use-after-free, uninitialized resource, incorrect authorization, race conditions, information leaks, integer overflows, type confusion, improper input validation, missing authorization, confused deputy, code injection, and UI misrepresentation issues across various components such as Chromecast, Browser, ANGLE, Omnibox, V8, Media, PDF, and others. These vulnerabilities collectively pose critical security risks. The update promotes Chromium 155 to stable and fixes these issues.
This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-09. It is categorized as OSINT related to network activity and payload delivery but lacks specific technical details or exploit information.
Red Hat has released a security advisory for Red Hat Hardened Images RPMs, including updates to golang1.27 packages. The update addresses bugs and enhancements related to CVE-2026-94444 and CVE-2026-94447. No specific details about the vulnerabilities or their impact are provided in the advisory. The update is available for multiple architectures including aarch64 and x86_64.
A denial of service vulnerability exists in libming versions through 0.4.8. The flaw is in the readtag_file() function located in src/blocks/fromswf.c, which can be triggered remotely without authentication. This vulnerability does not impact confidentiality or integrity but can cause service disruption.
Poppler versions from 0.42.0 through 26.10.0 contain a stack-based buffer overflow vulnerability in the Decrypt::revision6Hash() function. This flaw allows attackers who can control the password to potentially cause a denial of service. The vulnerability is classified as medium severity with a CVSS score of 6.5. Red Hat has released security updates for Hardened Images RPMs that address this issue by updating poppler packages to version 26.08.0-1.3.hum1. No known exploits are reported in the wild.