Threat database

CVE-2026-119501 is a stored cross-site scripting (XSS) vulnerability in BdThemes Element Pack Elementor Addons affecting versions prior to 10.0.3. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers with limited privileges to execute malicious scripts. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. A fix is available in version 10.0.3.

CVE-2026-19868 is a high-severity vulnerability in SonicWall's SonicOS SSL VPN component that allows an attacker with valid credentials for an alternate authentication method to bypass SAML authentication controls, including SAML-enforced multi-factor authentication (MFA). This flaw affects SonicWall Gen7 and Gen8 firewalls running SonicOS versions 7.3.3-7015 or older and 8.2.2-8015 or older, respectively. SonicWall has released patched versions 7.3.4-7013 and 8.2.3-8015 to address the issue. There are no known workarounds, and customers are urged to upgrade promptly. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, indicating potential exploitation in the wild.

CVE-2026-123961 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setWiFiBasicConfig function within the /cgi-bin/cstecgi.cgi file, where improper handling of the KeyStr argument allows remote attackers to trigger a buffer overflow. Public exploit code has been disclosed, increasing the risk of exploitation.

CVE-2026-121783 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Data Access plugin by Passionate Programmer Peter. It affects versions from initial releases up to 5.5.90. The vulnerability allows an attacker to induce a user to perform unwanted actions without their consent. A fix is available in version 5.5.91.

CVE-2026-119490 is a cross-site scripting (XSS) vulnerability in the Better Notifications for WP plugin by Made with Fuel Ltd. The flaw involves improper neutralization of script-related HTML tags, allowing code injection. It affects versions from initial releases up to 1.10.1. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 1.10.2.

Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.2.2.

CVE-2026-119500 is a stored cross-site scripting (XSS) vulnerability in bPlugins Flash & HTML5 Video html5-video-player versions prior to 2.14.2. The flaw involves improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. This vulnerability has a CVSS score of 6.5, indicating a medium severity level. A fix is available in version 2.14.2.

CVE-2026-120840 is a missing authorization vulnerability in the ThemeGrill User Registration plugin affecting versions prior to 5.3.1. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue has a medium severity rating and a CVSS score of 4.3. A fix is available in version 5.3.1.

CVE-2026-120842 is a missing authorization vulnerability in Brainstorm Force SureForms versions prior to 2.13.1. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The issue has a medium severity rating with a CVSS score of 5.3 and does not impact confidentiality or availability but affects integrity. A fix is available in version 2.13.1.

CVE-2026-119520 is a stored cross-site scripting (XSS) vulnerability in Brainstorm Force Spectra (ultimate-addons-for-gutenberg) affecting versions from initial release up to 2.20.4. It involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 2.20.5.

CVE-2026-119494 is a medium severity vulnerability in Gemini Labs Site Reviews (versions before 8.3.7) that allows code injection via improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) flaw. The issue is fixed in version 8.3.7.

CVE-2026-120850 is a stored cross-site scripting (XSS) vulnerability in Elementor Website Builder affecting versions prior to 4.3.6. The flaw involves improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts that execute in the context of other users. This vulnerability has a medium severity rating with a CVSS score of 6.5. A fix is available in version 4.3.6.

CVE-2026-119493 is a stored cross-site scripting (XSS) vulnerability in Ditty by Metaphor Creations, LLC. It affects versions from initial releases up to 3.1.71. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 3.1.72.

CVE-2026-123960 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setWanConfig function of the /cgi-bin/cstecgi.cgi file, where manipulation of the pppoeUser, priDns, or secDns arguments can trigger the overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code is available, increasing the risk of attacks.

CVE-2026-123959 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setLanguageCfg function within the /cgi-bin/cstecgi.cgi file, where manipulation of the langType argument can cause a buffer overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code has been released, increasing the risk of attacks.

CVE-2026-119507 is a medium severity vulnerability in WPDeveloper's NotificationX plugin that allows improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) issue. This affects NotificationX versions prior to 3.3.7. The vulnerability permits code injection but does not impact integrity or availability. A fix is available in version 3.3.7.

A critical buffer overflow vulnerability exists in TOTOLINK CA300-PoE version 6.2c.884 in the setIpQosRules function of /cgi-bin/cstecgi.cgi. The vulnerability is triggered by manipulation of the ipStart argument and can be exploited remotely without user interaction. Public exploit code has been disclosed.

A missing authorization vulnerability exists in WC Lovers WCFM Marketplace (wc-multivendor-marketplace) up to version 3.8.3. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a CVSS score of 4.3, indicating medium severity, with impact limited to integrity without affecting confidentiality or availability. No patch or official fix information is provided at this time.

A missing authorization vulnerability exists in WP ManageNinja LLC Fluent Booking plugin versions up to 2.5.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A stored cross-site scripting (XSS) vulnerability exists in WC Lovers WCFM Marketplace plugin versions up to and including 3.8.3. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.