The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
The VK Blocks plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its Group Block 'linkToPost' feature. This vulnerability affects all versions up to and including 1.126.1. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
The Link Library plugin for WordPress suffers from a time-based SQL Injection vulnerability in the 'link_url' parameter. This affects all versions up to and including 7.9.2. The flaw allows unauthenticated attackers to inject additional SQL commands due to insufficient escaping and lack of proper query preparation, potentially exposing sensitive database information.
The Tracking Code Manager plugin for WordPress has a reflected cross-site scripting (XSS) vulnerability via the 'TCM_ErrorMessages' POST parameter in all versions up to and including 2.6.0. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when a user is tricked into interacting with a crafted link. The issue arises from insufficient input sanitization and output escaping.
The Mang Board WordPress plugin (versions up to and including 2.4.0) contains a stored cross-site scripting (XSS) vulnerability via the 'data_type' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. It is caused by insufficient input sanitization and output escaping.
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin is vulnerable to reflected Cross-Site Scripting (XSS) via the 'title' parameter in all versions up to and including 1.8.42. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with crafted content.
Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress versions up to and including 4.5.14 is vulnerable to stored Cross-Site Scripting (XSS) via the 'ref' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The Premium Packages – Sell Digital Products Securely WordPress plugin contains an unauthenticated stored cross-site scripting (XSS) vulnerability in the 'order_email' parameter. This affects all versions up to and including 7.0.5. The vulnerability arises from insufficient input sanitization and output escaping, allowing attackers to inject malicious scripts that execute when users view the affected pages.
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 7.9.6. This flaw allows authenticated users with subscriber-level access or higher to delete arbitrary Media Library attachments due to improper authorization checks.
The Import and export users and customers plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in custom column user meta profile fields. This vulnerability affects all versions up to and including 2.4.5. Authenticated users with custom-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
The Ocean Extra plugin for WordPress contains a code injection vulnerability in all versions up to and including 2.6.0. This flaw allows unauthenticated attackers to execute arbitrary shortcodes due to improper validation before calling do_shortcode. The vulnerability is identified as CWE-94 and has a CVSS 3.1 score of 6.5, indicating medium severity.
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the Table Designer 'data-label' attribute. This vulnerability exists in all versions up to and including 1.27.13 and allows authenticated users with Contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The CVSS score is 6.4, indicating a medium severity risk.
The smartphone application "Vehicle Inspection Certificate Viewer" developed by the Ministry of Land, Infrastructure, Transport and Tourism has a vulnerability that may cause sensitive information to be disclosed through data transmitted by the app. No specific technical details or affected versions are provided. There is no indication of known exploits in the wild or available patches.
CVE-2026-76667 is a medium severity vulnerability in Hewlett Packard Enterprise HPE NonStop EXPAND involving an out-of-bounds memory read. This flaw could lead to integrity and availability impacts but does not affect confidentiality. The vulnerability requires high privileges and local access to exploit, with high attack complexity and no user interaction needed.
CVE-2026-76666 is a medium severity security vulnerability in Hewlett Packard Enterprise's HPE NonStop EXPAND product. It involves an out-of-bounds memory read, classified under CWE-125. The vulnerability requires local access with high privileges and high attack complexity, and does not involve user interaction. Confidentiality impact is high, while integrity impact is none and availability impact is low. No patch or remediation information is currently available.
CVE-2026-76665 is a high-severity vulnerability in Hewlett Packard Enterprise's HPE NonStop EXPAND product. It involves an out-of-bounds memory read that can lead to a buffer overflow condition. The vulnerability is identified as CWE-125. No specific affected versions or patch information are provided. The CVSS 3.1 base score is 7.1, indicating a high impact with local attack vector and high complexity.
An advanced spear-phishing campaign targets Taiwan research organizations using AI-assisted content generation to craft personalized, credible event invitations. The campaign employs real-time adversary-in-the-middle (AitM) phishing kits that impersonate Google authentication pages, relaying credentials and multi-factor authentication (MFA) tokens live to the attacker. The threat actor also uses QR code phishing (quishing) by modifying legitimate event posters with malicious QR codes to expand attack vectors. The phishing infrastructure uses hybrid HTTP and WebSocket architectures to synchronize authentication workflows and capture session cookies and device fingerprints. The campaign demonstrates sophisticated social engineering, leveraging legitimate event details and institutional impersonation to reduce suspicion. The phishing kits are localized primarily in Simplified Chinese and adapted for Traditional Chinese and English. Defenses such as passkeys, device-bound sessions, impossible-travel detection, and rapid takedown of lookalike domains are noted as potentially effective mitigations.