Threat database

CVE-2026-73790 is a high severity vulnerability in Hewlett Packard Enterprise's HPE NonStop iTP WebServer caused by improper input validation (CWE-20). This flaw can lead to memory corruption and potentially cause the system to shut down unexpectedly. No specific affected versions or patch information are provided.

CVE-2026-14851 is a critical vulnerability in Copart’s online billing service that exposes sensitive customer information such as names, addresses, invoice numbers, payment details, and tax information. The flaw arises from missing authorization checks on the endpoint serving PDF invoice files, allowing unauthorized access. Additionally, some invoice document URLs are publicly indexed by search engines, further exposing confidential data. Exploiting this vulnerability enables attackers to access and potentially enumerate sensitive financial and personal data.

CVE-2026-103671 is a vulnerability in the EC-CUBE AmazonPay V2 Plugin (4.0/4.1 series) that allows external control of a web parameter assumed to be immutable. This flaw can cause users to be redirected to arbitrary websites during the ordering process, potentially leading to unauthorized access to user account information. The vulnerability has a medium severity rating with a CVSS score of 4.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

The EC-CUBE AmazonPay Plugin for the EC-CUBE 4 series contains a vulnerability that allows external control of a web parameter that was assumed to be immutable. This could potentially lead to unexpected behavior or security issues in the plugin's operation.

The Gallery Custom Links plugin for WordPress up to version 2.3.3 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper input sanitization and output escaping of the 'display_name' and 'comment' parameters. Authenticated users with subscriber-level access or higher can exploit this by injecting malicious scripts that execute when other users view the affected pages. The attack requires coordinated inputs in both the comment body and the attacker's display name, leveraging the plugin's output buffering to bypass standard filters.

The Mang Board WordPress plugin up to version 2.4.3 is vulnerable to a Local File Inclusion (LFI) vulnerability via the '<mode>_type' parameter. This allows unauthenticated attackers to include and execute arbitrary PHP files on the server, potentially leading to code execution and access control bypass. Exploitation requires no authentication and can be performed via a POST request to any page rendering the [mb_board] shortcode, which lacks nonce or capability checks. The vulnerability is classified as CWE-98 and carries a high CVSS score of 8.1.

The Post Export Import with Media WordPress plugin up to version 1.17.1 is vulnerable to PHP Object Injection via deserialization of untrusted data. This vulnerability requires an attacker to have administrator-level access. Exploitation depends on the presence of a PHP Object Injection POP chain in other installed plugins or themes. Without such a POP chain, the vulnerability has no impact. If a POP chain exists, attackers may delete files, access sensitive data, or execute code.

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications WordPress plugin up to version 3.10.0 contains a critical privilege escalation vulnerability. An unauthenticated attacker can exploit a missing capability check in an AJAX action and a flawed exclusion list in user meta saving to create a new Administrator-level account. The required nonce is publicly exposed on all front-end pages, making exploitation trivial. This vulnerability allows full control over the WordPress site without authentication.

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_title' parameter. This affects all versions up to and including 2.8.190. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.

The Jeg Kit for Elementor WordPress plugin (versions up to and including 3.2.19) contains a missing authorization vulnerability. Authenticated users with Subscriber-level access or higher can exploit AJAX actions to enumerate all registered users and gradually reconstruct their email addresses via substring search. This vulnerability arises from missing capability checks on the 'jkit_post_block' and 'jeg_find_author' AJAX handlers.

The Record of Consent Extension for Complianz WordPress plugin versions up to and including 2.5 is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the 'uid' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The vulnerability is exacerbated because the nonce used for enforcement is exposed to unauthenticated frontend visitors, and no capability or role checks restrict the write path.

The Mang Board WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in the 'user_name' parameter in all versions up to and including 2.4.3. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The existing sanitizer mbw_htmlspecialchars2() does not prevent this attack due to the nature of the exploit payload.

The Meow Lightbox WordPress plugin versions up to and including 5.6.2 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of the 'display_name + comment' parameter, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. Exploitation requires the plugin's Output Buffering option to be enabled (which is disabled by default) and at least one previously approved comment by the attacker to enable auto-approval of subsequent comments. The vulnerability can lead to script execution in the context of users visiting the affected pages.

The Mang Board WordPress plugin up to version 2.4.3 is vulnerable to stored Cross-Site Scripting (XSS) via the 'content' parameter. Authenticated users with custom-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress versions up to and including 10.3.1 is vulnerable to Local File Inclusion (LFI) via the [lifterlms_checkout] shortcode. Authenticated users with Instructor-level access or higher can exploit this vulnerability by manipulating shortcode attributes to control the file path included by the plugin, potentially leading to arbitrary file inclusion and code execution.

ShopMagic – email automation for WordPress plugin versions up to 4.9.0 contains a Local File Inclusion vulnerability via the 'billing_address.first_name' parameter. This vulnerability allows unauthenticated attackers to include and execute arbitrary PHP files on the server. Exploitation is possible without authentication by submitting a specially crafted guest checkout using the default "New Order email with social media profile links" recipe, which processes the vulnerable placeholder. The flaw enables attackers to bypass access controls, access sensitive data, or execute arbitrary code if they can upload PHP files.

The PeproDev Branches Map plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 3.0.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with Contributor-level access or higher to inject malicious scripts. These scripts execute when any user accesses the affected page, potentially leading to unauthorized actions or data exposure.

The Appointment Booking Plugin – LatePoint for WordPress versions up to 5.7.3 contains a vulnerability that allows authenticated users with subscriber-level access or higher to expose sensitive booking information. This occurs via the 'params[customer][first_name]' parameter, enabling attackers to extract privileged data such as admin notes, internal contact details, transaction tokens, and payment URLs through notification emails. The issue arises when a crafted placeholder is stored in the first_name field and triggers the password-reset email flow, revealing sensitive information.

The Appointment Booking Plugin – LatePoint for WordPress versions up to 5.7.3 contains an authorization bypass vulnerability due to insecure direct object references in certain public AJAX routes. Unauthenticated attackers can enumerate booking and cart IDs to access other users' appointment details and pending checkout information without ownership verification.