CVE-2026-105002 is a high-severity code injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows arbitrary code execution by the management service when certain non-default configurations enable evaluation of customization content as code without proper restrictions.
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the target site's theme to register a color_scheme field on the user profile via Redux_Users::set_profile(), which causes the nonce to be rendered on /wp-admin/profile.php for every logged-in user, making it accessible to Subscribers.
The Affiliate Program Suite — SliceWP Affiliates WordPress plugin is affected by a SQL Injection vulnerability via the 'email' parameter in all versions up to and including 1.2.14. This flaw allows unauthenticated attackers to inject arbitrary SQL queries due to insufficient input escaping and lack of proper query preparation. The vulnerability is triggered during WooCommerce My Account registration through a guest-accessible nonce, enabling data extraction from the database without requiring authentication.
Tutor LMS plugin for WordPress up to version 4.1.2 has an authorization bypass vulnerability due to missing validation on a user-controlled key. Authenticated users with subscriber-level access and a valid API key can access paid course content without enrollment, retrieve quiz answers, and enumerate sensitive user information including instructors and administrators.
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that at least one prior comment from the attacker's name and email pair has been approved under WordPress's default comment_previously_approved moderation setting, and that a secondary language is configured in TranslatePress.
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user profile via Redux_Users::set_profile(), which causes the nonce to be printed into the subscriber's own /wp-admin/profile.php page source, making it directly readable without any additional privileges.
The Stop Spammers Classic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' POST parameter in versions up to, and including, 2026.6. An unauthenticated POST handled on init stores the attacker-supplied author field (after sanitize_text_field, which does not escape single quotes) into the ss_stop_sp_reg_stats option history. The Log Report admin page then renders that stored value inside a single-quoted JavaScript string within a double-quoted onclick attribute using esc_js(); because esc_js() uses _wp_specialchars with ENT_COMPAT it does not escape single quotes, allowing the stored value to break out of the JS string literal and inject arbitrary JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever an administrator with manage_options access clicks the 'Report to SFS' link on an attacker-poisoned log row (the StopForumSpam API key must be configured for that link to be rendered — the field is empty by default). Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_block_style' endpoint in all versions up to, and including, 3.19.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is scoped to the attacker's own user meta but is exposed publicly on their author archive page at /author/<slug>/, which is accessible to unauthenticated visitors regardless of whether the attacker has published any posts.
IBM Aspera Faspex versions 5.0.0 through 5.0.19 contain an authorization vulnerability that allows an authorized user to bypass normal user restrictions and gain full administrative privileges. This flaw is classified as CWE-863 (Incorrect Authorization) and has a critical severity rating with a CVSS score of 9.8.
The Jupiter X Core plugin for WordPress up to and including version 4.62.0 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to enumerate and render arbitrary published post types not intended for public viewing, including sensitive Flamingo CF7 submission records with personal data. Exploitation requires a specific widget configuration ('Is Archive Template' enabled) common in Jupiter X sites, and the nonce used for verification is ineffective as an authorization barrier.
The MotoPress Appointment Booking Lite plugin for WordPress versions up to and including 2.4.8 is vulnerable to a stored cross-site scripting (XSS) flaw via its public REST endpoint '/motopress/appointment/v1/customers/create'. This endpoint allows unauthenticated attackers to inject arbitrary scripts because the 'name' parameter is not sanitized before database insertion and not escaped on output in the admin bookings list. The vulnerability affects users with limited capabilities, such as the Appointment Employee role, enabling script execution when viewing injected pages.
The Social Slider Feed plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in the 'slidespeed' parameter affecting all versions up to and including 2.3.8. Authenticated users with subscriber-level access or higher can exploit this flaw to inject malicious scripts that execute on any page embedding the affected feed shortcode. This occurs due to insufficient input sanitization and output escaping, combined with a missing permission check that allows subscribers to bypass capability restrictions and manipulate feed settings.
The payever WooCommerce Gateway plugin for WordPress versions up to and including 4.8.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload executable PHP files, leading to remote code execution. This is due to three WooCommerce-API callbacks lacking authentication and capability checks, combined with an insecure file upload routine that writes attacker-controlled files before validating their type. Additionally, an unauthenticated hard-coded credential identity overwrite issue exists independently.
The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter. This affects all versions up to and including 7.5.56.7212. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and that the injected comment is approved before execution occurs on pages viewed by site visitors.
The iubenda All-in-one Compliance plugin for WordPress versions up to and including 3.13.6 is vulnerable to a stored cross-site scripting (XSS) flaw. This vulnerability arises from improper handling of HTML comments inside IUB-COOKIE-BLOCK markers, allowing unauthenticated attackers to inject arbitrary scripts via moderated comments that execute when viewed by users after administrator approval.
The Jupiter X Core plugin for WordPress versions up to and including 4.62.0 contains a directory traversal vulnerability via the 'file' parameter. This vulnerability allows unauthenticated attackers to read arbitrary files within the wp-content/uploads/ directory. The vulnerability is mitigated by a path confinement check that prevents access to files outside this directory, such as wp-config.php.
The Greenshift WordPress plugin (animation and page builder blocks) up to version 13.2.2 is vulnerable to sensitive information exposure. An unauthenticated attacker can exploit a crafted GET parameter to cause a logged-in user's HttpOnly WordPress session cookie (wordpress_logged_in_*) to be leaked via an image request to an attacker-controlled host. Exploitation requires that the site publisher has configured a public GreenShift Element image block with a {{GET:}} placeholder in the src attribute and that a logged-in user visits the malicious link. This vulnerability is not present in the plugin's default configuration.
The Form Maker by 10Web WordPress plugin up to version 1.15.50 is vulnerable to stored cross-site scripting (XSS) via a user-defined hidden input parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views a specific submissions page and interacts with a crafted entry. The flaw arises from insufficient input sanitization and output escaping in the handling of the 'wdform_<n>_element<id>' parameter. Exploitation requires an administrator to trigger the vulnerable functionality, leveraging their session and embedded nonce.
The Fluent Support plugin for WordPress versions up to and including 2.4.7 has a vulnerability allowing unauthenticated attackers to modify certain stored profile fields of linked customers. This occurs via the plugin's integration with Fluent Forms, where public form submissions can trigger ticket creation and update customer data without verifying email ownership. The vulnerability permits overwriting limited profile fields such as first and last name (only if unset), title, address, city, state, zip, and country, but not email, role, or status.