The WP Photo Album Plus WordPress plugin versions before 9.3.04.004 contain a vulnerability where the plugin does not verify the origin or a security token for a comment-management request. This flaw allows attackers to delete photo comments by tricking a logged-in user with comment-moderation rights into loading a crafted page.
The Photo Engine WordPress plugin versions up to 6.5.8 lack proper authorization checks on a REST API route used to update post data. This vulnerability allows authenticated users with Author-level access or higher to modify titles, content, excerpts, and other fields of arbitrary posts, pages, and attachments, including those owned by other users. The issue is fixed in version 6.6.0.
The Contact Form by Supsystic WordPress plugin versions before 1.11.1 lack validation of CSRF tokens or request origin on two administrator-only actions: bulk deletion of captured form submissions and wiping a form's statistics. This vulnerability allows attackers to trick logged-in administrators into sending forged requests that permanently delete stored contact leads and analytics data.
The LetterPress WordPress plugin versions before 2.4.0 do not properly sanitise and escape certain settings. This vulnerability allows high privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even if the unfiltered_html capability is disabled, for example in multisite WordPress setups.
The Appointment Booking Plugin for WordPress versions before 5.7.6 contains a vulnerability where several booking-form step content settings are not properly escaped before rendering on the public booking form. This allows high-privilege users, such as administrators, to inject JavaScript that executes in the browsers of visitors who load the form. In multisite environments, this vulnerability crosses a privilege boundary to unauthenticated visitors when administrators lack the unfiltered_html capability.
The Schema App Structured Data plugin for WordPress versions up to and including 2.3.2 contains a stored cross-site scripting (XSS) vulnerability via comment content when the 'Remove Microdata' output filter is enabled. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires that an administrator has enabled the 'Remove Microdata' option and approved the malicious comment.
An authorization bypass vulnerability exists in the /api/runscript functionality of FUXA version 1.3.2-2809. This flaw allows an attacker to execute privileged operations by sending a specially crafted unauthenticated HTTP request. The vulnerability has a medium severity rating with a CVSS score of 5.6.
The Social Web Suite WordPress plugin (up to version 4.1.12) contains a generic SQL Injection vulnerability via the 'exclude_posts' parameter. This flaw allows unauthenticated attackers to append arbitrary SQL queries to extract sensitive database information. The vulnerability is exacerbated by a bypassable HMAC authentication mechanism on fresh installations where the secret key is not yet generated.
The Frontend Dashboard WordPress plugin before version 3.0.5 and the ProfileGrid WordPress plugin before version 6.0.0.5 contain a vulnerability that allows unauthenticated users to store serialized PHP objects in user metadata. These objects are deserialized when a public profile is viewed, enabling PHP object injection that can lead to arbitrary file write and potential remote code execution.
SSL Wireless SMS Notification for WordPress versions up to and including 3.8.1 contains an authentication bypass vulnerability. The flaw allows unauthenticated attackers who know a phone-linked user's number to take over that account by exploiting improper verification in the final login step. The vulnerability arises because the final_login_ajax_action handler authenticates users based solely on attacker-controlled data without verifying the SMS OTP or server-side state.
An information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA version 1.3.2-2809. This flaw allows an unauthenticated attacker to send a specially crafted HTTP request that results in leaking information. The vulnerability has a medium severity rating with a CVSS score of 5.3.
In certain versions of Octopus Server with LDAP authentication enabled, any authenticated user could perform LDAP user and group searches. This vulnerability allows authenticated users to query LDAP directory information beyond their intended permissions.
The Wild Apricot Login plugin for WordPress up to version 1.0.18 has an authentication bypass vulnerability via SSO email-collision account binding. Attackers controlling a Wild Apricot contact with the same email as a WordPress administrator can authenticate as that admin without proof of account ownership. This allows obtaining a valid network-wide authentication cookie on WordPress Multisite networks, granting administrator access across subsites.
The SendPress Newsletters plugin for WordPress up to version 1.26.1.20 is vulnerable to a time-based SQL Injection via the 'subscriberid' parameter. This vulnerability arises from insufficient escaping of user input and inadequate preparation of SQL queries, allowing unauthenticated attackers to inject additional SQL commands. The nonce intended to protect the handler uses a hardcoded action value that is publicly accessible, effectively bypassing nonce-based access control.
The Food Store plugin for WordPress versions up to and including 1.5.5 contains a stored cross-site scripting (XSS) vulnerability via the 'service_type' cookie. An unauthenticated attacker can inject malicious scripts by supplying a payload through the ?type= query parameter on the public checkout page. This payload is stored in the cookie, persisted to order metadata, and rendered unescaped in the admin panel, leading to script execution when accessed.
An authorization bypass vulnerability exists in the /nodered functionality of FUXA version 1.3.2-2809. This flaw allows an attacker to send a specially crafted unauthenticated HTTP request that can lead to arbitrary code execution on the affected system. The vulnerability is critical with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
The Bot for Telegram on WooCommerce plugin for WordPress versions up to and including 1.3.0 contains an authentication bypass vulnerability. This flaw allows unauthenticated attackers to forge bot updates and impersonate any WordPress user by exploiting a REST endpoint that lacks proper permission checks and signature verification. Attackers can obtain a login token and gain persistent authenticated sessions without credentials, potentially taking over administrator accounts.
CVE-2026-118030 is a race condition vulnerability in the HOTP authentication mechanism of the keycloak-services component used by Red Hat Build of Keycloak. The flaw arises because the system validates a one-time password and updates its internal counter in two separate steps without proper synchronization. An attacker who already has a user's password could exploit this timing gap to reuse a single one-time password to log in multiple times concurrently. The vulnerability is rated as medium severity with a CVSS score of 4.2. Currently, no effective mitigation or patch meeting Red Hat's criteria is available.
CVE-2026-117859 is a moderate severity vulnerability in the Pushed Authorization Request (PAR) implementation of the keycloak-services component in Red Hat Build of Keycloak. The flaw occurs when an authentication flow is restarted, which incorrectly clears internal markers tracking PAR consumption while leaving the request active. This allows an attacker with valid client credentials to reuse the same authorization request to obtain multiple access tokens, bypassing the intended single-use restriction.
CVE-2026-117688 is a vulnerability in the client registration component of Red Hat Build of Keycloak. It allows an authenticated client owner to exploit a flaw in the vault provider integration to retrieve sensitive secrets in plaintext by updating a client secret reference and requesting the client configuration. Exploitation requires possession of a valid Registration Access Token and knowledge of Vault aliases. The vulnerability could lead to unauthorized disclosure of sensitive credentials.