Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including several LTS releases, contain a SQL Injection vulnerability (CWE-89). This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0.
Malicious Firefox extensions impersonating popular cryptocurrency wallets Phantom, Jupiter, and Bitget have been discovered stealing users' recovery phrases and private keys. These extensions use Unicode homoglyphs to mimic legitimate wallet names and exfiltrate credentials to brand-named subdomains of bonto.io. The Phantom impersonator uses a two-stage loader to fetch additional malicious payloads at runtime. The campaign also prepares infrastructure for targeting Coinbase and Exodus wallets. Stolen secrets allow attackers full control over victims' cryptocurrency wallets and assets.
In September 2026, infostealer malware was predominantly distributed via SEO poisoning, masquerading as illegal software like cracks and keygens. Distribution platforms included Mediafire, AWS S3, Mega, and Cloudflare Storage. Executable files made up 90.8% of samples, with 9.2% using DLL side-loading techniques involving legitimate DLLs such as python37.dll and POWRPROF.dll. A new Rust-based infostealer named Lzveil was identified, which downloads configuration from command and control servers and employs modified Base64 decryption, XOR encryption, and LZNT1 compression. Email campaigns spread DarkCloud and AgentTesla infostealers, impersonating construction and logistics firms. These malware variants steal credentials, browser data, cryptocurrency wallets, and system information, with stolen data often sold on dark web markets or used in secondary attacks.
CVE-2026-118435 is an out-of-bounds write vulnerability in the Samsung Open Source escargot project. This flaw allows buffer manipulation which can lead to integrity and availability impacts. The vulnerability has a medium severity rating with a CVSS score of 5.4. No affected versions or patches are explicitly stated in the available data.
The Enable Media Replace plugin for WordPress up to version 4.2.2 contains an authorization bypass vulnerability. Authenticated users with author-level access or higher can modify the post_content of any published post referencing replaced media, including posts owned by administrators. This occurs because the plugin's doReplaceQuery() method performs a database-wide search-and-replace without verifying per-post editing permissions, allowing unauthorized content changes visible to all visitors.
The Echo Knowledge Base plugin for WordPress has a reflected cross-site scripting (XSS) vulnerability in versions up to 17.214.0. This flaw arises from improper input sanitization and output escaping in certain plugin functions, allowing unauthenticated attackers to inject malicious scripts via the 'new_kb_config' parameter. Exploitation requires tricking users with Editor-level or higher privileges into clicking crafted links, potentially leading to script execution in their browsers.
MemberPress plugin for WordPress versions up to 1.14.1 is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a bypassable nonce verification in the save_profile_fields() function. This flaw allows unauthenticated attackers to change authenticated users' email addresses by tricking them into performing an action, potentially leading to account takeover via password reset.
CVE-2026-63286 is a vulnerability in AXIS Camera Station Pro where database backups use inadequate encryption strength, making them susceptible to offline attacks. Versions prior to 6.20 are affected. The product automatically creates an additional backup during updates, which remains vulnerable. Users should delete all vulnerable backups and change stored credentials after applying the patch.
Cozy Blocks – Website Builder for WordPress Block Editor plugin versions up to 2.2.27 are vulnerable to stored cross-site scripting (XSS) via certain block attribute parameters. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, specifically due to wp_kses_post not neutralizing certain payloads that do not contain '<' characters, allowing exploitation at render time.
The WP Inventory Manager WordPress plugin up to version 2.5.5 contains a time-based SQL Injection vulnerability via the 'sort_order' shortcode attribute. Authenticated users with contributor-level access or higher can exploit this flaw by embedding the vulnerable shortcode in a draft post preview, allowing them to append SQL queries and extract sensitive database information without publishing the post.
A stored cross-site scripting (XSS) vulnerability exists in the Hustle – Email Marketing, Lead Generation, Optins, Popups WordPress plugin up to version 7.8.14.3. The flaw arises from insufficient sanitization and escaping of the 'content[cta_label]' parameter, allowing authenticated users with custom-level access or higher to inject malicious scripts. By default, only administrators have the capability to edit modules, but this can be delegated to lower roles such as Subscribers, potentially enabling exploitation by less privileged users.
Tainacan WordPress plugin versions up to 1.3.0 have a directory traversal vulnerability via the 'tmp_file' parameter. Authenticated users with editor-level or higher privileges can exploit this to read arbitrary files on the server. The attack involves injecting a malicious path that is stored in the database and later accessed through a REST endpoint, exposing file contents.
The BeyondSEO WordPress plugin up to version 1.3.6 improperly grants elevated redirect management capabilities to the Contributor role. This allows authenticated users with Contributor-level access or higher to create, update, or delete site-wide redirects without additional authorization checks. Such unauthorized redirect control can lead to hijacking of arbitrary site paths, including sensitive endpoints like /checkout and /wp-login.
The Bit Flows plugin for WordPress up to version 1.31.0 contains a Local File Inclusion (LFI) vulnerability via the 'image' parameter used by the ImageHelper node. This flaw allows unauthenticated attackers to include and execute arbitrary PHP files on the server if certain webhook configurations are in place, potentially leading to code execution and sensitive data exposure. Exploitation requires an administrator to have configured a webhook-triggered flow that uses the vulnerable node and that the webhook is not protected by bearer secrets or IP allowlisting.
The VikRentCar Car Rental Management System WordPress plugin is vulnerable to blind SQL Injection via the 'catid' parameter in versions up to and including 1.4.10. Authenticated users with contributor-level access can exploit this flaw by injecting SQL queries through malicious blocks stored via the REST API and triggered during post preview. This vulnerability allows extraction of sensitive database information without user interaction. The vulnerability arises from insufficient escaping and lack of proper query preparation.
The Contact Manager plugin for WordPress up to version 9.1.2 contains an arbitrary file upload vulnerability due to improper handling of file extensions. This flaw allows unauthenticated attackers to upload potentially executable files by exploiting a trailing dot in filenames that bypasses extension checks. Successful exploitation can lead to remote code execution on servers running Apache with libapache2-mod-php, though the attack window is limited by file removal at request end.
The Document Embedder plugin for WordPress (versions up to 2.4.0) contains a stored DOM-based cross-site scripting (XSS) vulnerability. Authenticated users with contributor-level access or higher can inject malicious scripts via the 'content' parameter. The injected script executes when a user clicks the embedded document's Download button, exploiting an AJAX fallback mechanism that improperly handles document IDs, allowing bypass of normal download flow checks.
The Post Snippets – Custom WordPress Code Snippets Customizer plugin is vulnerable to stored cross-site scripting (XSS) in all versions up to 4.2.4. Authenticated users with contributor-level access or higher can inject malicious scripts via shortcode attributes. The vulnerability arises because entity-encoded payloads bypass WordPress's sanitization and are decoded and executed at render time by the plugin's shortcode filter. This requires snippet shortcodes to be enabled for exploitation.
The Hustle plugin for WordPress versions up to 7.8.14.3 contains a stored cross-site scripting (XSS) vulnerability via the 'content[title]' parameter. This flaw allows authenticated users with custom-level access and the 'Create and Update Modules' capability granted through the plugin's permissions to inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires explicit permission delegation and is not enabled by default.
The Product Addons for Woocommerce – Product Options with Custom Fields WordPress plugin up to version 3.1.8 is vulnerable to a stored cross-site scripting (XSS) flaw. This vulnerability arises from insufficient input sanitization and output escaping of the 'fields[section][fields][row][col][type]' parameter. Authenticated users with shop manager-level privileges or higher can exploit this to inject malicious scripts that execute when other users view the affected pages.