Apache Roller versions 4.0 through 6.1.6 contain a missing authorization vulnerability that allows any logged-in user to read unpublished weblog entries for which they have no assigned role. The vulnerability arises because the entry preview function only verifies that the user is logged in, not whether they have permission to view the specific weblog entry. Exploitation requires knowledge of the weblog name and the entry's link name. Upgrading to version 6.1.7 or later mitigates this issue by enforcing role-based access for entry previews.
CVE-2026-111824 is a cross-site scripting (XSS) vulnerability in Apache Roller 6.1.6. It allows an authenticated user with the Author role on a weblog using a custom theme to store malicious script that executes in the browsers of users who open the affected resource URL. The issue arises because media files uploaded with a user-chosen path were served with a content type based on that path, bypassing previous fixes that restricted media serving rules. Media uploads are disabled by default. Upgrading to Apache Roller 6.1.7 or later mitigates this vulnerability by enforcing consistent media serving rules and disallowing user-supplied paths in uploads.
CVE-2026-125433 is a stored cross-site scripting (XSS) vulnerability in the Futurio Extra plugin by FuturioWP. It affects versions from initial release up to 2.0.25. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts that execute in the context of other users. A fix is available in version 2.0.26.
CVE-2026-108338 is a cross-site scripting (XSS) vulnerability in Apache Roller versions 5.0.1 through 6.1.6. It allows an authenticated user with the Author role to inject script code into weblog entry tags via AtomPub. The vulnerability arises because HTML characters in tag names are not properly neutralized, and certain themes and macros render these tags without escaping, causing script execution in viewers' browsers. AtomPub is disabled by default, and the issue is mitigated in Apache Roller 6.1.7 and later, which removes HTML characters from tag names.
CVE-2026-105154 is a Cross-Site Request Forgery (CSRF) vulnerability in Apache Roller versions 4.0 through 6.1.6 affecting the Planet feed aggregator administration. An unauthenticated attacker can induce a logged-in global administrator to trigger the addition of a Planet subscription by visiting a crafted web page. This allows the attacker to make the server fetch arbitrary URLs, including internal addresses, and publish fetched feed content without authentication. The vulnerability arises because recent versions accept GET requests for this action, which are not protected by CSRF tokens. Apache Roller 6.1.7 and later address this issue by requiring POST requests with valid CSRF tokens and disabling the Planet aggregator by default.
CVE-2026-124416 is a missing authorization vulnerability in Ahmad WP Job Portal versions prior to 2.8.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue affects all versions from initial releases up to 2.7.2. A fix is available in version 2.8.0. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-105153 is an XML External Entity (XXE) vulnerability in Apache Roller versions 4.0 through 6.1.6. It allows any authenticated user, even without weblog permissions, to read files accessible by the Roller process and to cause the server to make outbound HTTP requests to attacker-controlled destinations. This occurs because the AtomPub endpoint parses Atom entries with an XML parser configuration that permits external entities and DTD subsets before authorization checks or feature enablement checks. The vulnerability is fixed in Apache Roller 6.1.7 and later, which use a hardened XML parser configuration and reject AtomPub requests when the feature is disabled.
CVE-2026-125778 is a medium severity vulnerability in the myCred plugin affecting versions prior to 4.0.3. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue that allows code injection. The vulnerability is fixed in version 4.0.3.
Apache Roller versions 4.0 through 6.1.6 contain a vulnerability that allows a weblog administrator to access another user's stored password hash by creating a custom weblog template. This occurs because the template can access the underlying persistent objects directly via a public accessor, bypassing intended data wrappers. The issue affects any weblog where the administrator can author templates without requiring non-default configurations. The vulnerability is addressed in Apache Roller 6.1.7 and later versions.
CVE-2026-124263 is a Cross-Site Request Forgery (CSRF) vulnerability in plainware Locatoraid Store Locator versions prior to 3.9.76. This flaw allows an attacker to trick authenticated users into submitting unwanted requests, potentially causing limited integrity and availability impacts. The issue is fixed in version 3.9.76.
Apache Roller versions 4.0 through 6.1.6 contain a vulnerability where any logged-in user can infer other users' email addresses by exploiting the user search functionality. The search matches input against email addresses as well as user names, allowing incremental confirmation of email addresses one character at a time. This issue is fixed in Apache Roller 6.1.7 and later, where the search for non-administrators only matches user names.
CVE-2026-125431 is a missing authorization vulnerability in the Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin. This flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to unauthorized modifications. The issue affects versions prior to 6.0.8 and has been fixed in version 6.0.8. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-124261 is a missing authorization vulnerability in Magepeople inc.'s Taxi Booking Manager for WooCommerce plugin. Versions from initial release up to 2.1.7 are affected. The flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to unauthorized modifications. The issue is fixed in version 2.2.9.
CVE-2026-125776 is a missing authorization vulnerability in Cozmoslabs Profile Builder versions prior to 4.0.7. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to certain profile builder functionalities. The issue is fixed in version 4.0.7.
CVE-2026-124496 is an authorization vulnerability in Apache Storm versions 3.0.0 up to but not including 3.2.0. The DRPC HTTP endpoint allows an authenticated user to impersonate another user without proper authorization checks, enabling execution of DRPC functions restricted to that other user. This issue is fixed in Apache Storm version 3.2.0.
CVE-2026-125450 is a stored cross-site scripting (XSS) vulnerability in Brainstorm Force's SureRank plugin affecting versions prior to 1.11.0. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. A fix is available in version 1.11.0.
CVE-2026-125762 is a stored cross-site scripting (XSS) vulnerability in LeapWorx Premium Addons for Elementor affecting versions prior to 4.11.117. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 6.5. A fix is available in version 4.11.117.
CVE-2026-124495 is a vulnerability in Apache Storm versions 3.0.0 up to but not including 3.2.0. It involves the Logviewer serving files via symbolic links placed by workers running as the topology owner, allowing users who can submit topologies to read logs and other files accessible to the Logviewer process. The issue is fixed in version 3.2.0.
Ninja Forms - File Uploads WordPress add-on up to version 3.3.36 contains a critical path traversal vulnerability allowing unauthenticated attackers to delete arbitrary files on the server. The flaw arises from improper handling of client-supplied file paths in background upload processing, bypassing directory containment checks. Deleting key files like wp-config.php can force WordPress into setup mode, enabling full site takeover.
CVE-2026-125045 is a stored cross-site scripting (XSS) vulnerability in John-Michael L'Allier's Create software. It affects versions from initial releases up to 3.1.1. The vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to execute malicious scripts in the context of other users. A fix is available in version 3.1.2.