The Greenshift – animation and page builder blocks plugin for WordPress (versions up to and including 13.2.2) contains a vulnerability that allows unauthenticated attackers to extract authenticated users' HttpOnly WordPress session cookies. This occurs via a crafted GET parameter that injects a nested {{COOKIE:}} placeholder, causing the victim's browser to send cookie values to an attacker-controlled host. Exploitation requires a specific site configuration and user interaction, which are not default states of the plugin.
The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[<custom_meta_field_id>]' parameter in all versions up to, and including, 4.62.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Execution requires that the attacker-registered account be assigned as the post_author of a page or post whose template includes the Raven Author Box widget, a fixture an administrator can create by reassigning authorship to any user including newly registered Subscribers.
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'jsticket_message' parameter in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload fires specifically when an administrator or agent opens the affected ticket and the page initializes VenoBox, which reads the browser-decoded data-title attribute and passes it to jQuery .html(), making routine ticket review the trigger condition.
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires the plugin to be in its normal connected state (cdn_key and cdn_secret configured) with the image replacer enabled, which is the default post-setup configuration; the stored payload bypasses all WordPress comment sanitization filters because it contains no HTML metacharacters at storage time — the characters are produced only by Optimole's own decoder at render time.
The LearnPress – Course Review plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'review_title (inside `data.args.review_title`)' parameter in all versions up to, and including, 4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes after an administrator approves the submitted review, though sites with comment_previously_approved auto-approval configured may bypass manual moderation.
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s[make]' parameter in all versions up to, and including, 1.4.128 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Free Listing Submission feature to be enabled, which is shipped on by default via the Setup Wizard demo configuration.
The payever WooCommerce Gateway plugin for WordPress up to version 4.8.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload executable PHP files. This occurs because three API callbacks lack authentication and validation, enabling remote code execution. The vulnerability is critical with a CVSS score of 9.8.
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdform_<n>_element<id> (Hidden Input field, name = user-defined, e.g. hidden_probe)' parameter in all versions up to, and including, 1.15.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to open the Submissions screen and click the Show-on-Map link associated with the poisoned entry, at which point the attacker-controlled field_id value is echoed unescaped into a single-quoted JavaScript string in the FormMakerEditCountryinPopup popup — a step whose nonce and capability checks are automatically satisfied by the administrator's own session and the freshly minted fm_ajax_nonce embedded in the link.
CVE-2026-120453 is a heap out-of-bounds read vulnerability in The Sleuth Kit up to version 4.15.0, specifically triggered via the HFS+ decmpfs header. The affected product version explicitly noted is version 3.0. No CVSS score or detailed impact information is provided.
A NULL pointer dereference vulnerability exists in The Sleuth Kit up to version 4.15.0 related to decmpfs LZVN decompression. This flaw could cause the software to crash or behave unexpectedly when processing certain inputs.
CVE-2026-120640 is a vulnerability affecting CGI versions before 5.00 for Perl. It involves the ability to set the POSTDATA, PUTDATA, PATCHDATA, and XForms:Model parameters in an unintended manner. The advisory references the Microsoft Support Lifecycle for software support details but does not provide further technical or impact specifics.
A vulnerability exists in CGI versions before 5.00 for Perl that allows open redirects through HTML entity decoding of the URL after application processing. This issue is identified as CVE-2026-120638 and is associated with CWE-180. The affected version explicitly stated is version 3.0. No CVSS score or detailed impact information is provided.
CVE-2026-120637 is a vulnerability affecting CGI versions before 5.00 for Perl, where request parameters are taken from the process command line arguments for an unrecognized condition. The advisory references Microsoft products but provides no detailed technical or impact information. No patch or remediation details are provided.
CVE-2026-120633 is a vulnerability in CGI versions before 5.00 for Perl where the software trusts the client-supplied X-Forwarded-Host header in url, self_url, and virtual_host. This could potentially lead to security issues related to improper validation of host headers. The affected product is Microsoft CGI for Perl version 3.0. No CVSS score or detailed impact information is provided.
A vulnerability exists in CGI versions before 5.00 for Perl that allows CPU exhaustion through a backtracking regular expression in the XForms multipart/related processing. This can lead to denial of service conditions by consuming excessive CPU resources.
CVE-2026-120634 is a vulnerability in CGI::Carp versions before 5.00 for Perl that causes warnings to leak across requests in persistent environments. The issue relates to improper handling of warnings, potentially leading to information leakage between requests. No CVSS score or detailed impact information is provided.
A vulnerability exists in CGI versions before 5.00 for Perl where an infinite loop can occur on a short request body if the $DISABLE_UPLOADS variable is set. This issue is identified as CWE-835 (Loop with Unreachable Exit Condition). The affected version explicitly stated is version 3.0. No CVSS score or patch information is provided, and no known exploits are reported in the wild.
CVE-2026-120650 affects CGI versions before 5.00 for Perl, allowing memory, CPU, and disk exhaustion due to missing or unenforced request size limits. This vulnerability can lead to resource exhaustion on affected systems.
A vulnerability in CGI versions before 5.00 for Perl allows HTML injection when text containing the sequence '-->' is included in comments. This issue is identified as CVE-2026-120648 and is associated with Microsoft products. The affected version explicitly stated is version 3.0. No CVSS score or detailed impact information is provided.
CVE-2026-120647 is a vulnerability in CGI versions before 5.00 for Perl that allows Content-Disposition parameter injection via unescaped double quotes. The vulnerability relates to improper handling of input leading to injection risks. No CVSS score or detailed impact information is provided. No patch or remediation details are available in the provided data.