The RSS Aggregator by Feedzy WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'item_title' parameter parsed from feed item titles. This affects all versions up to and including 5.2.13. An attacker can inject malicious scripts into pages viewed by users if an administrator has configured a Feed-to-Post import with a malicious feed URL. The vulnerability arises from insufficient input sanitization and output escaping.
The AMP for WP – Accelerated Mobile Pages plugin for WordPress versions up to and including 1.1.18 contains a vulnerability that allows authenticated users with custom-level access or higher to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before calling the do_shortcode function. The vulnerability is linked to the 'ampforwp-cat-description' setting, which is enabled by default, making most installations affected without additional configuration changes.
The AAA Autoload Optimizer WordPress plugin up to version 1.7.0 is vulnerable to stored cross-site scripting (XSS) via the 'option_page' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. Exploitation requires the plugin's Option Tracking setting to be in 'Legacy' mode. The vulnerability arises from insufficient input sanitization and output escaping, and it bypasses WordPress's HTTP 403 response due to filter execution order.
Apache James SASL OAuthBearer/XOAUTH2 versions prior to 3.9.1 do not correctly validate the AUD claim in JWT payloads when introspection is not configured. This flaw allows attackers with valid credentials to access the mail server without proper authorization. Users are advised to upgrade to version 3.9.1 or later, which enforces explicit AUD claim configuration and introspection.
The Smart Cookie Kit WordPress plugin up to version 2.3.2 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires an administrator to approve the malicious comment and then view the affected post, triggering script execution.
The Advanced Members for ACF WordPress plugin versions up to and including 1.3.0 contain a privilege escalation vulnerability. This flaw arises from a PHP operator-precedence bug that causes an authorization check to incorrectly pass for any logged-in user. As a result, attackers with Subscriber-level access or higher can reset the password of the primary administrator account (user ID 1), gaining full administrative control of the site.
Certain docker-compose files shipped by the project expose the Webadmin REST API publicly by default without proper authentication. Starting with version 3.9.1, the project mitigates this by setting a random credential on unprotected Webadmin endpoints to prevent unauthorized access while maintaining convenience.
The Pubjet WordPress plugin versions up to and including 5.4.8 contain a privilege escalation vulnerability. This flaw arises because the AJAX handler `wp_ajax_pubjet-check-token` does not perform capability checks or nonce verification before writing attacker-supplied tokens into the site-wide settings. Authenticated users with Subscriber-level access or higher can exploit this to overwrite the plugin's REST API credentials, gaining elevated privileges to invoke restricted plugin endpoints and manipulate content and plugin state.
The WP Customer Area plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'display_name' parameter affecting all versions up to and including 8.4.0. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
The ELEX WordPress HelpDesk & Customer Ticketing System plugin up to version 3.3.8 contains a critical vulnerability allowing unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient file path validation in the factory_reset function. Exploitation involves a two-step process where an attacker first submits a ticket to set a malicious file path, then triggers the factory reset functionality, which lacks proper capability checks. Deleting sensitive files like wp-config.php can lead to remote code execution.
The BuddyForms plugin for WordPress up to version 2.10.5 is vulnerable to stored cross-site scripting (XSS) via the 'bf_post_type' and 'buddyforms_form_content' parameters. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires a BuddyForms form with public submissions enabled and an active theme with a widgetized sidebar, enabling malicious Custom HTML widgets to be injected and executed on the front end.
Apache James server versions prior to 3.9.1 have an improper Access Control List (ACL) processing vulnerability in the JMAP protocol. This flaw arises because the JMAP protocol does not correctly handle negative ACL rules set by the IMAP protocol, allowing users to administer folders despite explicit denial of rights in IMAP. Upgrading to version 3.9.1 resolves this issue.
The BuddyForms WordPress plugin up to version 2.10.5 contains a critical privilege escalation vulnerability. This flaw allows unauthenticated attackers to create administrator accounts by exploiting a form-type confusion issue via the bf_post_type parameter. The vulnerability arises because the plugin authorizes frontend submissions based only on a public_submit flag and trusts attacker-supplied post type data for new objects, bypassing important checks. Additionally, a missing capability check and nonce validation in the save_post listener enable attackers to persist malicious form configurations that grant admin privileges upon user registration. Exploitation requires the WordPress site to have 'Anyone can register' enabled and at least one public BuddyForms form, which are common default settings.
A vulnerability in Moodle allows unauthenticated remote attackers to bypass access control checks on H5P content files. This flaw enables unauthorized viewing of restricted materials, including content in the system context and files from hidden or unavailable course modules, leading to information disclosure of protected content.
The All-in-One Video Gallery WordPress plugin up to version 5.0.0 is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'custom_fields[].value.label' parameter when the Player Library is set to Plyr/Vidstack. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping in the Plyr/Vidstack template path.
The WPSyncSheets For Contact Form 7 plugin for WordPress contains a remote code execution vulnerability in all versions up to and including 1.8.0. The flaw arises from insufficient sanitization of Contact Form 7 submission fields before database storage and lack of restrictions on deserialization during admin retrieval. Exploitation requires a configured Google Sheets access token, which triggers autoloading of a vulnerable Monolog library, enabling unauthenticated attackers to execute code on the server.
Saxy's XML encoder has a vulnerability where processing instructions are written verbatim without validation or escaping. This allows an attacker to inject arbitrary XML elements, attributes, or further processing instructions by manipulating the target or content fields. The flaw affects versions from 0.7.0 up to but not including 1.7.0. The impact depends on how the XML output is consumed, potentially leading to forged records, injected stylesheets, or active content execution in browsers. The CVSS score is low, reflecting limited impact and complexity.
CVE-2026-66294 is an XML injection vulnerability in the Saxy XML encoder affecting versions from 0.7.0 before 1.7.0. The vulnerability arises because the encoder's CDATA serialization does not properly handle the ]]> substring, allowing attackers to prematurely terminate CDATA sections and inject arbitrary XML markup. This can lead to forged or overridden trusted fields in XML documents such as SOAP envelopes, RSS/Atom feeds, sitemaps, SVG, or other XML exports that include untrusted text in CDATA nodes. Applications that do not place untrusted text in CDATA nodes are not affected. The CVSS score is low (2.1).
A vulnerability in JetBrains YouTrack versions before 2026.2.19562 allows project administrators of one project to delete version control system (VCS) integrations owned by another related project. This issue arises from improper access control between related projects.
A vulnerability in JetBrains YouTrack versions before 2026.2.19562 allows sprint creation to move issues from projects that the user cannot access. This issue could lead to unauthorized modification of issue assignments between sprints.