Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
The AnyComment WordPress plugin versions up to and including 0.3.6 contain a stored cross-site scripting (XSS) vulnerability via the 'email' parameter in the /wp-json/anycomment/v1/subscribe REST endpoint. This vulnerability arises from insufficient input sanitization and missing output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when an administrator views the Subscriptions admin page.
Abandoned Cart Pro for WooCommerce plugin versions up to and including 10.8.0 suffer from an authentication bypass vulnerability due to insecure encryption and HMAC implementation. Attackers can exploit this flaw to forge cart-recovery tokens and gain unauthorized access to any user's account, including administrators. The vulnerability arises from the use of MAC-free AES-CTR encryption with a user-controlled key and an HMAC check that can be bypassed by omitting a parameter. The plugin's auto-login feature is enabled by default and forced on during upgrades, increasing exploitability.
Abandoned Cart Pro for WooCommerce plugin versions up to 10.8.0 are vulnerable to an unauthenticated SQL Injection via the 'validate' parameter. This vulnerability allows attackers to append arbitrary SQL queries due to insufficient input escaping and lack of proper query preparation. The plugin uses AES-CTR encryption which is malleable, enabling attackers who obtain a legitimate token to forge SQL-carrying ciphertexts. Although an HMAC check was introduced in version 10.4.1, it is only enforced when the 'wcap_nonce' parameter is present, allowing attackers to bypass it by omitting this parameter.
Abandoned Cart Pro for WooCommerce plugin versions up to and including 10.8.0 contain a critical SQL Injection vulnerability. The flaw arises from improper sanitization of user input in the update_guest_persistent_cart() function, allowing unauthenticated attackers to inject SQL commands via the guest cart persistent meta_value. This vulnerability enables attackers to extract sensitive data and escalate privileges by modifying usermeta entries, including elevating arbitrary accounts to administrator.
The Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) contains an arbitrary file upload vulnerability due to insufficient validation in the save-to-cache.php script. This script lacks WordPress bootstrap, authentication, capability, and nonce checks, allowing authenticated users with subscriber-level access or higher to upload executable PHP files. The vulnerability arises because the pluginURL parameter is only filtered with FILTER_SANITIZE_URL, which does not prevent PHP payload injection. Uploaded PHP code is written to cached-content/cached-feed.php and can be executed via a GET request, enabling remote code execution.
This entry is a daily security news update from the SANS Internet Storm Center (ISC) dated October 14th, 2026. It provides general information about the ISC Stormcast podcast and related resources but does not contain any specific security threat, vulnerability, or exploit details.
CVE-2026-82715 is an insecure temporary file vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. It affects versions 01-00 of the AIX driver and 01-04 of the Virtual I/O Server driver prior to 01-23-/A. The vulnerability could allow an attacker with local privileges to cause high impact on integrity and availability. The CVSS score is 7.9 (high severity).
CVE-2026-86573 is an out-of-bounds write vulnerability in the Hitachi Disk Array Driver for AIX and the Hitachi Disk Array Driver for Virtual I/O Server. It affects specific versions starting from 01-00 up to but not including 01-23-/A for AIX, and from 01-04 up to but not including 01-23-/A for the Virtual I/O Server. The vulnerability has a medium severity with a CVSS score of 5.1 and can cause integrity loss and high availability impact without confidentiality compromise.
CVE-2026-86607 is an internal application information exposure vulnerability in Hitachi Ops Center Administrator versions before 11.0.9-01. It involves generation of error messages that contain sensitive information, potentially leaking internal application details. The vulnerability has a medium severity with a CVSS score of 4.3. No known exploits are reported in the wild. The affected versions are all releases from initial up to but not including 11.0.9-01.
CVE-2026-110392 is a critical OS command injection vulnerability in Samsung Open Source QA-Board. It involves improper neutralization of special elements used in OS commands, allowing an attacker to execute arbitrary commands on the affected system. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No affected versions or patch information are provided. No known exploits are reported in the wild.
The Click to Chat for WhatsApp plugin for WordPress by HoliThemes contains a critical code injection vulnerability (CVE-2026-92097) in versions up to and including 4.44. This flaw allows unauthenticated attackers to execute arbitrary shortcodes by manipulating URL input that is improperly sanitized before being processed. The vulnerability arises because the plugin substitutes user-controlled URL data into greeting templates and passes them to the WordPress do_shortcode() function without removing shortcode delimiters, enabling execution of any shortcode registered by WordPress core, themes, or other plugins.
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin contains an authorization bypass vulnerability in all versions up to and including 8.10.2.1. Authenticated users with subscriber-level access or higher can delete business directory listings owned by other users, including posts in published, draft, or private status. The plugin fails to properly verify user authorization, and the nonces used do not provide an effective authorization barrier because they are exposed to all logged-in users.
The BP Profile Search plugin for WordPress up to version 5.9 contains a Local File Inclusion (LFI) vulnerability via the 'ajax_template' parameter derived from a client-controlled cookie. This flaw allows unauthenticated attackers to include arbitrary PHP files on the server, potentially leading to remote code execution if malicious PHP files are present or can be uploaded. The vulnerability arises from insufficient validation of the template file path, lacking basename restrictions, whitelisting, or path traversal checks.
The Membership & User Roles for WooCommerce (Automatic Role Changer) WordPress plugin contains a privilege escalation vulnerability in versions up to and including 20260828. This flaw allows authenticated users with subscriber-level access or higher to regain previously revoked Administrator roles by exploiting the plugin's role cache mechanism. Exploitation requires the Replace Roles mode to be enabled and that the attacker’s account had legitimately held the Administrator role before revocation. The vulnerability stems from the plugin unconditionally re-assigning cached roles without verifying their current validity from the external provider.
The Database Addon for Contact Form 7 – CFDB7 WordPress plugin versions up to 1.4.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to delete arbitrary files. This occurs because the plugin stores arbitrary submission fields and uses a delete handler that deletes files based on stored keys containing 'cfdb7_file' without proper validation. The vulnerability has a medium severity rating with a CVSS score of 5.3.
The Printcart Store plugin for WooCommerce (versions up to and including 2.9.1) contains an unauthenticated arbitrary file upload vulnerability. This flaw allows attackers to upload malicious PHP files via the nbdesigner_copy_image_from_url AJAX action, which is accessible without authentication. The vulnerability arises because the plugin improperly rebuilds the destination filename from attacker-controlled input, bypassing file type restrictions and enabling remote code execution. The exploit requires no user interaction or privileges, making it critical.
The Bit integrations plugin for WordPress (versions up to and including 2.10.6) contains a privilege escalation vulnerability. This flaw allows unauthenticated attackers to overwrite the administrator's password and take over the admin account. The issue arises because attacker-controlled data is stored without validation and later replayed in an administrator session, enabling password changes without proper authorization. Exploitation requires specific plugin configuration and an administrator to re-execute a logged failure.
The Booking Package WordPress plugin up to version 1.7.29 is affected by a stored cross-site scripting (XSS) vulnerability via the 'id' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
The Booking Package plugin for WordPress up to version 1.7.29 has an authorization bypass vulnerability. This flaw allows unauthenticated attackers to access personally identifiable information of all booked customers, including names, emails, phone numbers, addresses, and cancellation tokens. The vulnerability arises because the plugin fails to properly verify user authorization. The nonce intended to protect the endpoint is a public CSRF token exposed on pages using the booking_package shortcode or widget, making it easily accessible to attackers.