The Joinchat – Enhanced "click to chat" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable via Query Parameter Name in all versions up to, and including, 6.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that an administrator has configured a telephone number and included the {HREF} dynamic variable in the Call-to-Action text.
CVE-2026-93487 is a high-severity vulnerability in Octopus Server where incorrect authorization validation allows users with certain permissions to create project triggers that enable them to run runbooks or create deployments without proper authorization. This flaw affects specific versions of Octopus Server prior to fixed releases 2026.2.13487 and 2026.3.15863.
In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator.
Apple released security updates across multiple platforms to address 10 vulnerabilities, including Bluetooth and AirPlay pairing flaws, iMessage group chat issues, and an exploited Brotli bug. Several Bluetooth and AirPlay flaws allow attackers within Bluetooth range or on the same network to bypass pairing code limits or pair without user interaction. Two iMessage vulnerabilities could allow unauthorized access to group chats or earlier conversations. The updates cover iOS, iPadOS, macOS, watchOS, and visionOS with specific fixes for certain devices. No exploitation in the wild has been reported for these Apple-specific vulnerabilities.
Red Hat has issued a security advisory for the gcc compiler packages addressing two vulnerabilities: an integer wrap in the std library (CVE-2026-114691) and a confirmed out-of-bounds read/write in the libstdc++ parallel std library (CVE-2026-114690). These issues affect multiple architectures of Red Hat Enterprise Linux 8 and related products. The update is rated as having a moderate security impact. No CVSS score is provided in the advisory, and no known exploits are reported in the wild.
The YITH WooCommerce Gift Cards WordPress plugin through version 4.39.0 has a vulnerability where it issues gift cards credited with the item's pre-discount price rather than the amount actually paid. This allows customers to combine store coupons with gift card purchases to obtain gift cards worth more than their payment.
The Security For WooCommerce WordPress plugin versions through 1.0.16 have a vulnerability where one of its REST API routes is not access-restricted. This allows unauthenticated users to retrieve detailed reports about the server, PHP, WordPress configuration, installed plugin versions, and the site administrator's email address.
The Security For WooCommerce WordPress plugin up to version 1.0.16 has a vulnerability where one of its REST API routes is accessible without authentication. This flaw allows unauthenticated users to retrieve the email addresses of all administrators on the affected site.
The Security For WooCommerce WordPress plugin through version 1.0.16 has a vulnerability where it does not verify if the requester is authorized before regenerating secret keys and salts in the site's configuration file. This flaw allows unauthenticated users to log out every user on the site. Additionally, on servers that cannot reach the WordPress.org API, this can corrupt the configuration file and take the entire site offline.
The Security For WooCommerce WordPress plugin versions through 1.0.16 contain a vulnerability that allows unauthenticated users to forcibly log out any user, including administrators, by exploiting a lack of authorization checks when ending user sessions. Attackers can repeatedly send logout requests to keep targeted users logged out.
The Knowledge Building WordPress plugin versions before 0.7.3 contain a vulnerability where comments submitted through the reply feature are not properly sanitized or escaped. This flaw allows unauthenticated users to inject stored cross-site scripting (XSS) payloads, which are then published without moderation. As a result, any visitor to the affected posts, including administrators, can be subjected to these XSS attacks.
The Security For WooCommerce WordPress plugin up to version 1.0.16 lacks authorization checks before executing bulk plugin and WordPress core updates. This flaw allows unauthenticated users to trigger the installation of all pending updates on the affected site.
The ProfilePress WordPress plugin versions before 4.17.6 have a vulnerability where some content protection rules are not properly evaluated when content is rendered outside the main query. This flaw allows unauthenticated users to access protected page content via the REST API.
The iChart WordPress plugin versions before 2.2.4 lack proper capability and ownership checks in multiple AJAX actions. Instead, they rely solely on a nonce accessible to any logged-in user, including those with the Subscriber role. This flaw allows such users to read, modify, and permanently delete arbitrary posts and overwrite a site-wide option.
A vulnerability in the Gravity Forms WordPress plugin before version 3.2.2 allows unauthenticated users to upload files without proper file type restrictions via its chunked file upload feature. This flaw can lead to unauthorized reading of server environment variables and file contents within the web root on servers configured to parse Server-Side Include (SSI) documents, such as Apache with SSI enabled.
The Security For WooCommerce WordPress plugin up to version 1.0.16 contains a vulnerability where it does not verify if the requester is authorized before executing certain comment cleanup actions. This flaw allows unauthenticated users to permanently delete all comments on the site, including approved comments and WooCommerce order notes.
A vulnerability in the Event Tickets and Registration WordPress plugin before version 5.30.3.1 allows unauthenticated users to retrieve the names of attendees for events that do not display a public attendee list. This occurs because the plugin does not properly verify whether an event's attendee list is public before returning attendee information via the REST API.
The Simpler Checkout WordPress plugin versions before 1.5.4 have a vulnerability where the plugin does not properly restrict order creation permissions and uses an automatic login link with a key that remains empty until the store owner completes plugin setup. This flaw allows subscriber-level users on stores that have not completed setup to log in as administrators.
The Security For WooCommerce WordPress plugin up to version 1.0.16 lacks proper authorization checks when resetting its settings. This flaw allows unauthenticated users to reset any section of the plugin's configuration to default values, potentially disabling critical security features such as custom login URLs, two-factor authentication, reCAPTCHA, password policies, and the firewall.
The Photo Engine WordPress plugin versions before 6.6.2 do not properly sanitize and escape keyword names before storing and displaying them on a debugging page. This flaw allows users with the Author role and above to perform stored cross-site scripting (XSS) attacks against administrators who view the debugging page.