Threat database

CVE-2026-120853 is a missing authorization vulnerability in Brainstorm Force CartFlows versions prior to 3.3.1. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in version 3.3.1.

CVE-2026-120852 is a medium severity vulnerability in Brainstorm Force's CartFlows plugin that allows code injection via improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) flaw. This affects CartFlows versions from initial releases up to 3.3.0. The vulnerability has been fixed in version 3.3.1.

CVE-2026-123469 is a medium severity vulnerability in The Events Calendar plugin by Liquid Web / StellarWP. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue that allows code injection. Versions from initial releases up to 6.18.3 are affected. The vulnerability has been fixed in version 6.18.3.1.

CVE-2026-119491 is a missing authorization vulnerability in David Lingren's Media LIbrary Assistant affecting versions prior to 3.44. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality. The issue has a medium severity rating with a CVSS score of 4.3 and is fixed in version 3.44.

CVE-2026-61990 is a missing authorization vulnerability in WC Lovers WCFM Membership plugin versions before 2.12.1. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 2.12.1.

CVE-2026-119484 is a Cross-Site Request Forgery (CSRF) vulnerability in the Photo Gallery by Supsystic plugin affecting versions before 1.21.7. This flaw allows an attacker to trick authenticated users into performing unwanted actions. The vulnerability is fixed in version 1.21.7.

CVE-2026-120847 is a missing authorization vulnerability in the Wpmet Metform plugin affecting versions prior to 4.3.4. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized modification of data. The issue has a medium severity rating and was fixed in version 4.3.4.

CVE-2026-119511 is a Missing Authorization vulnerability in the Saeed MC Woocommerce Wishlist plugin, versions prior to 2.0.4. It allows attackers to exploit incorrectly configured access control, potentially leading to unauthorized actions that impact the integrity of the system. The issue is fixed in version 2.0.4.

CVE-2026-121766 is a missing authorization vulnerability in Blubrry Podcasting PowerPress Podcasting affecting versions prior to 11.18.2. It allows exploitation due to incorrectly configured access control security levels, potentially leading to limited confidentiality and integrity impacts. The issue is fixed in version 11.18.2.

CVE-2026-123466 is a missing authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress. It affects versions from the initial release up to 2.3.18. The flaw allows unauthorized access due to incorrectly configured access control security levels. A fix is available in version 2.3.19.

CVE-2026-121768 is a stored cross-site scripting (XSS) vulnerability in the Contact Form 7 – Post Fields plugin by Markus Wiesenhofer. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. This vulnerability affects versions from initial releases up to 2.7.0. A fix is available in version 2.7.1.

CVE-2026-52713 is a missing authorization vulnerability in ThimPress LearnPress affecting versions prior to 4.4.13. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized information disclosure or modification. The issue has been addressed in version 4.4.13.

CVE-2026-119467 is a missing authorization vulnerability in WPVibes AnyWhere Elementor plugin versions prior to 1.3.1. This flaw allows attackers with limited privileges to exploit improperly configured access controls, potentially leading to integrity and availability impacts. The issue is fixed in version 1.3.1.

CVE-2026-66669 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Suplugins Superb Addons: Blocks, Patterns & Theme Designer versions prior to 4.2.5. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue is fixed in version 4.2.5.

CVE-2026-119510 is a stored cross-site scripting (XSS) vulnerability in Saeed MC Woocommerce Wishlist versions prior to 2.0.4. The flaw arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. This vulnerability affects versions from initial releases up to 2.0.3 and has a CVSS score of 6.5, indicating a medium severity level.

CVE-2026-123958 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setLanConfig function of the /cgi-bin/cstecgi.cgi file, where manipulation of the lanDns, lanSecDns, or langType arguments can trigger the overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code is available, increasing the risk of exploitation.

CVE-2026-121781 is a missing authorization vulnerability in WP ManageNinja LLC's Fluent Booking plugin. It affects versions from initial releases up to 2.5.0. The flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 2.6.0.

CVE-2026-119489 is a stored cross-site scripting (XSS) vulnerability in the WP Recipe Maker plugin by Bootstrapped Ventures. It affects all versions from initial releases up to 10.9.1. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to inject malicious scripts. A fix is available in version 10.9.2.

CVE-2026-120849 is a missing authorization vulnerability in WC Lovers WCFM Marketplace versions prior to 3.8.4. It allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 3.8.4.

CVE-2026-120848 is a stored cross-site scripting (XSS) vulnerability in WC Lovers WCFM Marketplace versions prior to 3.8.4. The flaw involves improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. This vulnerability has a medium severity rating with a CVSS score of 6.5 and affects versions from initial releases up to 3.8.3. A fix is available in version 3.8.4.