Threat database

Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.

CVE-2026-61992 is a critical vulnerability in the GEO my WordPress plugin (version 4.5.5.3 and earlier) that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-61991 is a critical vulnerability in AjaxLoadMore Cache versions up to 3.1.1 that allows unauthenticated remote code execution due to improper control of code generation (CWE-94). This flaw enables an attacker to execute arbitrary code on the affected system without authentication.

CVE-2026-61989 is a high-severity vulnerability in Easy Property Listings version 3.5.25 and earlier. It allows unauthenticated attackers to perform Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability.

CVE-2026-61988 is a high-severity vulnerability affecting Auction Nudge – Your eBay on Your Site versions up to 8.4.0. It is an unauthenticated Cross-Site Scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial confidentiality, integrity, and availability impacts.

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

CVE-2026-54865 is a cross-site scripting (XSS) vulnerability affecting Podamibe Custom User Gravatar versions up to 1.0.8. This flaw involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to execute malicious scripts in the context of other users. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-54864 is a high-severity vulnerability in nicashmu Post Video Players versions up to 1.165. It is an unauthenticated Cross Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can execute in the context of users' browsers.

CVE-2026-54860 is a critical vulnerability in ThemeREX Ozisti versions up to 1.1.10 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-54859 is a critical vulnerability in ThemeREX Preservation versions 1.15 and earlier. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, which can lead to full system compromise. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-54858 is a critical vulnerability in ThemeREX Printy versions up to 1.13.0 involving unauthenticated PHP object injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.

CVE-2026-54857 is a critical vulnerability in ThemeREX Quirky versions up to 1.23 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of affected systems.

CVE-2026-54856 is a critical vulnerability in ThemeREX's RexCoin product, affecting versions up to and including 1.2.6. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability.

CVE-2026-42701 is a high-severity vulnerability in YayCommerce's YayMail plugin versions up to 4.4.6. It involves PHP Object Injection due to deserialization of untrusted data, allowing a shop manager with privileges to potentially execute harmful actions. The vulnerability has a CVSS score of 7.2, indicating significant impact on confidentiality, integrity, and availability.

CVE-2026-42692 is a high-severity vulnerability in WP Crowdfunding versions up to 2.2.2 that allows unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks due to improper neutralization of input during web page generation.

Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.

CVE-2026-27394 is a high-severity vulnerability in Jyothis Joy Eventer versions up to 0.1.1 that allows unauthenticated attackers to perform Cross Site Scripting (XSS) due to improper neutralization of input during web page generation.

CVE-2026-118085 is a high-severity vulnerability in GlobalPayments WooCommerce versions up to 1.23.3. It is an unauthenticated Cross Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can impact confidentiality, integrity, and availability.

Zimbra Collaboration versions prior to 10.1.21 are vulnerable to a stored cross-site scripting (XSS) flaw in the Classic UI. The vulnerability arises from improper sanitization of the From email header during HTML reply composition. An attacker can craft an email with a malicious From header containing JavaScript, which executes when the victim replies in HTML mode with reply headers disabled. This may allow session theft or unauthorized actions. The issue is fixed in version 10.1.21.

Zimbra Collaboration versions prior to 10.1.21 are vulnerable to a stored cross-site scripting (XSS) flaw via the Content-Location MIME header in email attachments. An unauthenticated attacker can send a crafted email containing a malicious Content-Location header set to a javascript: URI. When a victim opens the email in the Zimbra web interface and clicks the attachment name, the embedded JavaScript executes in the victim's browser context. This vulnerability was fixed in version 10.1.21.