CVE-2026-116086 is a code injection vulnerability in konflux-ci where an attacker with permission to trigger automated workflows can inject malicious filter commands via crafted issue titles. This leads to information disclosure of sensitive data such as API credentials, deployment keys, and internal notes in workflow logs. The vulnerability affects specific versions of konflux-ci and does not allow direct OS code execution or cluster compromise.
A vulnerability in konflux-ci causes sensitive GitHub access tokens to be stored in plaintext on CI runners without cleanup after execution. This allows a local attacker with access to the CI environment to read these tokens and gain unauthorized repository access, potentially modifying source code or release artifacts. Exploitation requires prior code execution on the runner, limiting remote exploitation. No effective mitigation is currently available according to the vendor advisory.
The Newsletters plugin for WordPress up to version 4.18.1 contains a time-based SQL Injection vulnerability in the 'id' parameter. This flaw allows authenticated users with subscriber-level access or higher to inject additional SQL queries due to insufficient input escaping and validation. Attackers can obtain necessary authentication tokens by subscribing through the public form and exploiting weak ownership checks, potentially extracting sensitive database information.
FeedWordPress plugin for WordPress versions up to and including 2026.0517 is vulnerable to stored Cross-Site Scripting (XSS) via syndicated RSS/Atom feed content. The vulnerability arises because the plugin's content sanitization is insufficient, allowing unauthenticated attackers controlling an external feed to inject malicious scripts that execute when users access the injected pages.
The WP Activity Log plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 5.6.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The Acadlix LMS plugin for WordPress versions up to and including 1.1.9 contains a path traversal vulnerability in the post_delete_assessment_file_by_id function. This flaw allows authenticated users with subscriber-level access or higher to delete arbitrary files on the server due to insufficient file path validation. The vulnerability is exacerbated by weak permission checks relying on a publicly exposed nonce, effectively allowing unauthenticated exploitation. Successful exploitation can lead to remote code execution by deleting critical files such as wp-config.php.
The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the 'display_name' parameter. This affects all versions up to and including 4.0.9. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users interact with the affected author filter block on pages containing certain grid or live-filter blocks.
The All in One SEO – AI SEO Plugin for WordPress up to version 5.0.3 contains a vulnerability that allows unauthenticated attackers to extract sensitive non-public post meta data. This includes sensitive custom fields such as API keys and internal notes, which are exposed via the 's' parameter and included verbatim in the HTML title element and JSON-LD SearchResultsPage schema. The vulnerability is classified as CWE-200, Exposure of Sensitive Information to an Unauthorized Actor.
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications WordPress plugin up to version 3.10.2 contains an arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to upload potentially executable files by bypassing extension and MIME type validation through a trailing-dot filename. The vulnerability arises from missing server-side file key allowlist and inadequate pre-sanitization in the handle_upload function. The only access control is a nonce embedded in public forms, which is easily obtainable by any visitor, enabling remote code execution.
The Booking for Appointments and Events Calendar – Amelia WordPress plugin up to version 2.4.12 has a vulnerability that allows unauthenticated attackers to access sensitive personal information. This includes staff full names, email addresses, phone numbers, gender, timezones, and internal administrator notes for published events. The exposure occurs because the plugin fails to remove the raw providers array from JSON responses when processing the 'page' parameter.
The local-commander-agent npm package version 0.3.52 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
A privilege escalation vulnerability exists in the User Frontend plugin for WordPress versions up to and including 4.3.13. Authenticated users with Subscriber-level access or higher can exploit this flaw by injecting a specially crafted shortcode into a published post, which renders a registration form that allows creation of Editor-level accounts with active sessions. This occurs due to inconsistent sanitization of the post_content parameter and bypass of shortcode blocklist checks.
The Wp Social Login and Register Social Counter WordPress plugin up to version 3.2.2 contains an authentication bypass vulnerability. This flaw allows unauthenticated attackers to gain authenticated sessions as any existing WordPress user, including administrators, by exploiting improper verification of OAuth provider email addresses. The vulnerability arises because the plugin's REST callback accepts any email returned by Facebook or Twitter OAuth providers without proper verification, enabling attackers controlling an OAuth account with a matching email to bypass password checks.
Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress versions up to 2.2.4 is vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability arises from improper sanitization of HTML meta descriptions extracted from remotely fetched articles, which are then stored and rendered without filtering. This allows unauthenticated attackers controlling RSS feed content to inject malicious scripts that execute when users view the affected pages.
The WPO365 | MICROSOFT 365 GRAPH MAILER WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 6.2. This vulnerability arises from insufficient input sanitization and output escaping of the 'Subject' parameter used in mail-sending features. An unauthenticated attacker can inject malicious scripts that execute when users access the affected pages. The issue is present immediately after plugin activation if OAuth authorization is not completed, which is the default state. A fix is available for this vulnerability.
The Project Manager plugin for WordPress (versions up to 4.1.1) contains a critical vulnerability allowing unauthenticated remote code execution via the 'id' parameter. This occurs because the 'id' parameter is unsanitized and used directly in a dynamic PHP function call without allowlist validation. The vulnerability bypasses authorization checks due to WordPress core executing the validation callback before permission checks. This flaw has a CVSS score of 9.8, indicating a critical severity level.
The Redux Framework WordPress plugin up to version 4.5.15 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can view sensitive configuration data, including plaintext passwords, API keys, license keys, and SMTP credentials, exposed in the admin profile page. This occurs because the plugin does not properly verify user authorization for certain actions. The vulnerability affects all sites running Redux Framework due to the automatic loading of the Users extension by any registered Redux instance.
The Perfect Images WordPress plugin (versions up to and including 7.2.0) has a missing authorization check in its /wp-json/wp-retina-2x/v1/replace REST API endpoint. This vulnerability allows authenticated users with Author-level or higher privileges to replace files they do not own within the plugin's functionality.
The WP2LEADS WordPress plugin up to version 3.5.6 contains a time-based SQL Injection vulnerability in the 'order' parameter. This flaw allows authenticated users with Subscriber-level access or higher to inject additional SQL queries due to insufficient input escaping and query preparation. Exploitation can lead to unauthorized extraction of sensitive database information. The vulnerability has a CVSS score of 6.5, indicating a medium severity risk.
The User Frontend plugin for WordPress by wedevs, versions up to 4.3.13, is vulnerable to reflected cross-site scripting (XSS) via the 'field_attr[required]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. The nonce check intended to protect the AJAX action is ineffective because the nonce value is publicly accessible to anonymous visitors, enabling attackers to harvest it and bypass protections.