Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper validation of integrity check value vulnerability. This flaw could allow a high privileged attacker with local access to bypass protection mechanisms. The vulnerability is identified as CVE-2026-90720 and has a CVSS v3.1 score of 6.7, indicating a medium severity impact. No public exploits or patches are currently documented.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a path traversal vulnerability. This flaw allows a high privileged attacker with local access to potentially cause a denial of service. The vulnerability does not impact confidentiality but may affect system availability. The CVSS score is 3.4, indicating a low severity level.
The Echo Knowledge Base plugin for WordPress versions up to and including 17.214.0 is vulnerable to reflected cross-site scripting (XSS) via the 'new_kb_config' parameter. This occurs because attacker-controlled JSON data can be merged into the knowledge base configuration and injected into a <style> element without proper escaping. The vulnerability requires the attacker to trick a user with Editor-level or higher privileges into clicking a crafted link, leading to script execution in the context of the victim's browser.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Releases), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an OS Command Injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS v3.1 base score of 7.2, indicating high severity. No public exploits or patch information are provided in the available data.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and certain LTS releases contain an SQL Injection vulnerability. This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability has a low CVSS score of 2.7, indicating limited impact. No public exploits or patches are currently documented.
The Post Snippets WordPress plugin up to version 4.2.4 is vulnerable to stored cross-site scripting (XSS) via shortcode attributes. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing entity-encoded payloads to bypass WordPress's standard sanitization and be executed at render time by the plugin's shortcode filter. This requires snippet shortcodes to be enabled.
The Enable Media Replace plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 4.2.2. This flaw allows authenticated users with author-level access or higher to modify the content of any published post referencing replaced media, including posts owned by administrators. The vulnerability arises because the plugin's doReplaceQuery() method performs a database-wide search-and-replace without verifying user permissions on each post. Changes made via this method become immediately visible to all visitors.
The Beyondseo WordPress plugin versions up to and including 1.3.6 contain an authorization vulnerability that allows users with Contributor-level access to escalate privileges. This occurs because the plugin grants elevated capabilities to the Contributor role without sufficient permission checks on REST API endpoints managing redirects. Exploiting this flaw, an attacker can create, update, or delete site-wide redirects, potentially hijacking arbitrary paths such as /checkout or /wp-login.
The Mang Board plugin for WordPress versions up to and including 2.4.5 is vulnerable to stored cross-site scripting (XSS) via the 'align' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when any user views the affected page. The vulnerability arises from insufficient input sanitization and output escaping, allowing the malicious payload to persist through WordPress's wp_kses_post filtering because it contains no angle brackets. This enables script execution in viewers' browsers, including administrators previewing posts.
The Clean Login WordPress plugin versions up to and including 1.20.1 have a missing authorization vulnerability. This flaw allows authenticated users with Contributor-level access or higher to overwrite certain plugin options by embedding shortcodes in posts they author. The vulnerability arises from a missing capability check in a function triggered on post save.
The VikRentCar Car Rental Management System plugin for WordPress versions up to and including 1.4.8 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation. This vulnerability allows unauthenticated attackers to inject arbitrary PHP code into the plugin's executable template files by tricking an administrator into performing an action. The injected code bypasses sanitization and can lead to remote code execution on the server. Exploitation requires administrator interaction and cannot be triggered solely by the attacker.
The CMB2 plugin for WordPress up to and including version 2.13.4 is vulnerable to a stored cross-site scripting (XSS) flaw via a wysiwyg field inside a repeatable group. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. Exploitation requires the site integrator to render the plugin's front-end form helper with the vulnerable field on a publicly accessible page.
The DesignSetGo WordPress plugin up to version 2.11.0 contains a stored cross-site scripting (XSS) vulnerability via the 'tagName' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that become active when an administrator runs the plugin's block-conversion migration during deactivation. This vulnerability requires administrative action to trigger the payload, as attackers cannot activate it independently.
The PayPal Brasil para WooCommerce plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 1.7.8. This flaw allows unauthenticated attackers to enable or disable the PayPal Brasil BCDC payment gateway and modify its WooCommerce gateway settings, effectively removing PayPal as a payment option for all customers.
The MxChat – AI Chatbot & Content Generation plugin for WordPress contains a stored DOM-based cross-site scripting (XSS) vulnerability in the 'feedback' parameter. This affects all versions up to and including 3.2.25. The flaw allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the Transcripts page. The vulnerability arises from insufficient input sanitization and output escaping.
The Hustle WordPress plugin, used for email marketing and lead generation, is vulnerable to stored cross-site scripting (XSS) via the 'content[cta_label]' parameter in all versions up to and including 7.8.14.3. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with custom-level access or higher to inject malicious scripts. By default, only administrators have the required capability, but this can be delegated to lower roles such as Subscribers, potentially enabling exploitation by less privileged users.
The Bit Flows plugin for WordPress up to version 1.31.0 is vulnerable to a Local File Inclusion (LFI) flaw via the 'image' parameter used by the ImageHelper node. This vulnerability allows unauthenticated attackers to include and execute arbitrary PHP files on the server if certain webhook configurations are in place, potentially leading to code execution or access control bypass. Exploitation requires an administrator to have configured a webhook-triggered flow using the vulnerable node without additional security controls like bearer secrets or IP allowlists.
The VikRentCar Car Rental Management System plugin for WordPress contains a blind SQL Injection vulnerability in the 'catid' parameter affecting all versions up to and including 1.4.10. This flaw allows authenticated users with contributor-level access or higher to inject additional SQL queries via a specially crafted block stored through the REST API and triggered by previewing a post. The vulnerability arises from insufficient escaping and lack of proper query preparation, enabling extraction of sensitive database information. The vulnerability has a CVSS score of 6.5, indicating medium severity. No public exploits or patches are currently documented.
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress versions up to 2.3.6 contains an authorization bypass vulnerability. Authenticated users with contributor-level access or higher can exploit this flaw to duplicate arbitrary posts, including private, draft, and pending posts authored by higher-privileged users. This duplication exposes sensitive content such as the original post's content, excerpt, title, taxonomies, and metadata. The vulnerability arises because the plugin does not properly verify user authorization and uses a static nonce action that is not bound to specific posts, allowing nonce reuse against any post ID.
The Waitlist WooCommerce (Back in stock notifier) plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'type' shortcode attribute. This affects all versions up to and including 2.9.1. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because shortcode attribute values are not sanitized by the wp_kses_post filter and are only processed at render time.