The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state. This discards configuration changes an administrator made after upgrading and, where those changes had restricted a definition's visibility, silently re-exposes the definition and its content to anonymous visitors.
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.
The WP Ultimate Review WordPress plugin versions before 2.4.5 do not properly neutralize shortcodes in all review fields submitted via its public review form. This form is accessible to unauthenticated visitors, allowing them to submit reviews containing arbitrary shortcodes. If user reviews and the affected fields are displayed, these shortcodes can be executed, potentially leading to limited confidentiality and integrity impacts.
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
On October 21, 2026, the LiteLLM Python proxy library version 1.107.0 was compromised in a supply chain attack. The malicious release was available on PyPI and official Docker images for approximately two hours. Attackers used stolen GitHub CLI OAuth tokens from three engineers to deploy a malicious fork via a private release workflow. The payload included a credential stealer targeting cloud, developer, AI-tool, browser, and LiteLLM proxy credentials, as well as a second-stage remote access trojan backdoor. The malware executes automatically whenever Python starts by placing files in the site-packages directory. This is the second known supply chain compromise of LiteLLM in 2026, unrelated to the previous incident linked to TeamPCP activity.
NT OneAPP by NewType Infortech has a vulnerability (CVE-2026-114223) where sensitive information such as plaintext usernames and passwords can be extracted from backup data. This occurs when an unauthenticated local attacker obtains ADB backup access authorization and the user confirms the backup operation. The vulnerability is due to cleartext storage of sensitive information in backup data. It affects versions from 0 up to and including 1.5.22. The CVSS score is 6.7, indicating a medium severity risk.
NT OneAPP by NewType Infortech contains an authentication bypass vulnerability (CWE-287) that allows unauthenticated local attackers to bypass the app's PIN lock via a deep link, gaining access to protected resources of a logged-in user. The vulnerability affects versions from 0 up to and including 1.5.22. The CVSS 4.0 score is 6.9, indicating medium severity. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.
NT OneAPP by NewType Infortech has a credential disclosure vulnerability (CVE-2026-114221) where unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source within the WebView. This can lead to disclosure of the NUP Portal passcode of a logged-in user. The vulnerability affects versions from 0 up to and including 1.5.22. The CVSS 4.0 score is 5.9, indicating a medium severity issue.
NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.
NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.
CVE-2026-114732 is an authentication bypass vulnerability in Roundcube Webmail affecting versions 1.6.0 through before 1.6.20 and 1.7.0 through before 1.7.5. The flaw occurs in multi-host installations where logging in with an alias address could authenticate a user to a different IMAP host's account due to improper qualification of the alias lookup by IMAP host. This issue was fixed upstream by qualifying alias logins by IMAP host.
Roundcube Webmail versions before 1.6.20 and 1.7.5 are vulnerable to an uncontrolled resource consumption issue in the CSS proxy feature. This vulnerability allows an attacker to cause excessive memory usage by referencing a stylesheet URL from an attacker-controlled host, which is read into memory without size limits or timeouts. The issue was fixed by adding a 5 MB size limit, streaming reads, and applying a read timeout to the CSS proxy content processing.
Roundcube Webmail versions 1.6.14 through 1.6.19 and 1.7.0 through 1.7.4 contain a server-side request forgery (SSRF) vulnerability due to an incomplete network blocklist in the is_local_url() filter. This allowed bypass via certain NAT64 prefixes and the unspecified address, enabling crafted URLs to access internal loopback, link-local, and cloud metadata addresses. The issue was fixed upstream by updating the filter to include these missing address ranges.
CVE-2026-114729 is a vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 that allows remote content blocking to be bypassed. The issue arises because the remote content blocker did not inspect the SVG SMIL animation attribute 'by', allowing remote content to load without user consent. This can disclose the client IP address and confirm that a message was opened. The vendor has fixed this issue in a commit addressing the bypass via the 'by' attribute.
CVE-2026-114728 is a medium severity vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. It involves a remote content blocking bypass due to incomplete handling of CSS escape sequences in FuncIRI attributes. This flaw allows remote content to be loaded from HTML messages without user consent. The issue was fixed by normalizing CSS escapes before matching and expanding attribute inspection.
CVE-2026-114577 is a medium severity SQL injection vulnerability in the oretnom23 php-travel-agency-system. It affects the admin/insert.php file's Insertion Handler component, where manipulation of several parameters can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Although the issue was reported early, the project has not yet responded or issued a fix. Public exploit code is available, increasing the risk of exploitation.
This entry is a daily security news update from the SANS Internet Storm Center (ISC) titled 'ISC Stormcast For Thursday, October 22nd, 2026'. It provides general situational awareness and threat level information but does not contain specific details about a security vulnerability or threat.