Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool Formkit Lite extensions-for-elementor-form allows Code Injection.This issue affects Cool Formkit Lite: from n/a through 2.7.10.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. WpBookingly service-booking-manager allows Stored XSS.This issue affects WpBookingly: from n/a through 1.4.3.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.3.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Stored XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Code Injection.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.6.
The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'help_title' parameter in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A vulnerability in the WpTravelly tour-booking-manager plugin by Magepeople inc. allows improper control of filenames used in PHP include/require statements, leading to PHP Local File Inclusion. This affects versions up to 2.3.8. The vulnerability has a high severity with a CVSS score of 8.8, indicating potential for significant impact on confidentiality, integrity, and availability.
The Download Manager plugin for WordPress versions up to and including 7.5.9 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of the 'wpdm_reg[first_name]', 'wpdm_reg[last_name]', and 'wpdm_reg[user_login]' parameters. Exploitation requires the WordPress site to have user registration enabled, the plugin's registration form shortcode published on a public page, and at least one package authored by user ID 1 displayed with the Spotlight link template. An unauthenticated attacker can inject malicious scripts that execute when users access the affected pages.
The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field() in Inc/Style22::register_child() (and Inc/Style18, 19, 20, 25, 29) — which preserves the double-quote character — and then concatenating the stored value into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and the corresponding Style18/19/20/25/29 renderers) with no esc_attr() escaping. This makes it possible for authenticated attackers, with contributor-level access and above (when an administrator has delegated the plugin's 'Who can edit' capability via the plugin Settings page, or on multisite installations where even administrators lack unfiltered_html), to inject arbitrary web scripts in pages that will execute whenever a user accesses any page containing an affected [oxilab_flip_box] shortcode or block.
CVE-2026-123989 is a medium severity vulnerability in ESEngine DeepSeek-Reasonix up to version 1.33.0. It affects the loadGitStatus function in the build.rs file of the Build Script Execution component. The vulnerability involves permission issues that can be triggered remotely by manipulating this function. Upgrading to version 1.34.0 addresses the issue.
The qzc690384 package on PyPI contains malicious code that executes during installation by overriding the install command. It performs environment fingerprinting, exfiltrates basic system data such as IP address and username, and sets up a backdoor server to receive remote commands. The package downloads further commands from a hardcoded location and appears to prepare for additional stages of attack. This behavior is confirmed as part of a malicious campaign targeting users who install this package.
Treeio versions up to 2.0 have an insecure deserialization vulnerability in the UpdateRecord.get_format_strings and ModuleSetting.loads functions. This flaw allows authenticated staff users to execute arbitrary Python code on the web server by storing crafted base64-encoded pickle payloads in the UpdateRecord format_strings field via the Django admin interface. The vulnerability arises from unverified deserialization of pickle data during news feed rendering.
CVE-2026-124317 is a buffer over-read vulnerability in libexpat versions up to 2.10.0. It occurs in the functions unknown_toUtf8() and unknown_toUtf16() when processing application-registered unknown encodings. An attacker can craft a document with a truncated multibyte sequence causing the parser to read beyond the buffer, potentially leaking adjacent memory or causing a crash.
CVE-2026-124316 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.121.4 and 16.x before 16.36.0. The flaw exists in the whitelisted method erpnext.buying.utils.get_linked_material_requests, which lacks proper document or company permission checks. This allows authenticated users, including portal users or users without assigned roles, to supply item codes and retrieve open Purchase-type Material Requests belonging to other companies.
CVE-2026-124315 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.121.4 and 16.x before 16.36.0. The flaw exists in the whitelisted methods get_bom_items and get_bom_diff, which bypass BOM read permission checks. This allows any authenticated user, including portal or no-role users, to retrieve detailed bill of materials data such as raw materials, quantities, rates, and costs without proper authorization.
CVE-2026-124314 is a missing authorization vulnerability in Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0. It affects the erpnext.crm.utils.get_open_activities function, allowing any authenticated user, including portal or no-role users, to supply arbitrary parameters to enumerate ToDo and Event records, exposing private calendar event details.
CVE-2026-124313 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.121.4 and 16.x before 16.36.0. It allows any authenticated user, including portal users, to access Payment Ledger Entry allocation data for invoices and vouchers belonging to other companies by supplying arbitrary parameters to the get_linked_payments_for_doc method.