A vulnerability in the Download Manager WordPress plugin versions before 3.3.73 and before 7.6.2 allows unauthenticated visitors to download password-protected and role-restricted files. This occurs because the plugin does not verify access permissions before issuing download keys via media-preview renderers, exposing sensitive files to unauthorized users.
The Live Composer WordPress plugin versions before 2.1.24 contain a vulnerability where some staff member settings are not properly sanitized and escaped before being output on pages. This flaw allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even if the unfiltered_html capability is disabled, such as in multisite WordPress setups.
A race condition in HTTP/1 servers using MaxBytesReader or MaxBytesHandler can cause a runtime panic and crash when the request body reading and response header writing occur concurrently after exceeding the MaxBytesReader limit.
The Live Composer WordPress plugin versions before 2.1.24 have a vulnerability where some Button module settings are not properly sanitized and escaped before being output on the front end. This flaw allows high-privilege users, such as administrators, to perform stored cross-site scripting (XSS) attacks even if the unfiltered_html capability is disabled, such as in multisite WordPress setups.
The User Registration & Membership WordPress plugin versions prior to 5.3.2 fail to enforce the payment-before-login restriction if a registration is submitted without selecting a membership. This flaw allows unauthenticated users to create accounts on payment-gated registration forms and log in without completing payment.
The Live Composer WordPress plugin versions before 2.1.24 contain a vulnerability where some page-builder module settings are not properly sanitized and escaped. This flaw allows users with access to the builder, typically administrators, to inject arbitrary JavaScript code. The injected script executes when any visitor views the affected page, impacting even administrators in multisite environments where the unfiltered_html capability is disabled.
The Code Snippets WordPress plugin versions prior to 4.1.0 have a vulnerability in multisite environments where network-level capability checks are not performed on snippet import routes. This allows a subsite administrator without network-management rights to create, overwrite, or deactivate network-wide snippets affecting the entire network.
The User Registration & Membership WordPress plugin versions prior to 5.3.2 contain a vulnerability where the plugin does not verify that a payment has been completed before extending a paid membership subscription. This flaw allows authenticated users with an active paid subscription to renew their membership indefinitely without making additional payments.
A vulnerability in the User Registration & Membership WordPress plugin before version 5.3.2 allows unauthenticated users to exploit improperly validated discount coupons. This flaw permits users to obtain roles mapped to paid membership plans without payment, potentially escalating privileges up to administrator if the plan is linked to a privileged role.
The Live Composer WordPress plugin versions before 2.1.24 do not properly sanitise and escape certain module settings before outputting them in href attributes. This vulnerability allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even if the unfiltered_html capability is disabled, for example in multisite WordPress setups.
A vulnerability in the Go toolchain allows a malicious package using cgo to bypass "#cgo LDFLAGS" validation, potentially leading to unexpected code execution during build time or causing the go command to panic. This occurs due to improper parsing of "//go:cgo_ldflag" directives, where backslash escapes were not handled correctly, allowing disallowed linker flags to be passed to the external linker. Additionally, a slice bounds check issue could cause a panic in the go command during LDFLAGS deduplication. The issue has been addressed by properly handling escaped quotes and fixing the slice bounds check.
The Elementor Website Builder WordPress plugin versions before 4.3.6 contain a vulnerability where an element identifier is not validated or escaped before being rendered into a client-side attribute evaluated as JavaScript. This flaw allows users with the Contributor role to inject scripts that execute in the browsers of anyone viewing the affected content, including administrators reviewing submissions.
A vulnerability in the Go compiler and linker on Windows allows malicious packages using "//go:cgo_import_dynamic" directives or crafted PE objects to pass unsafe library arguments to the external linker. The issue arises because the compiler previously only checked the first character of library names and did not validate imported DLL names extracted from PE files, enabling path traversal and special character injection. The compiler and linker now fully validate library names and reject unsafe characters and path traversal sequences.
On Darwin systems, a vulnerability exists where building a malicious package using cgo with certain linker flags can lead to arbitrary code execution. This occurs because the Apple linker recombines separated '-l' and 'to_library' arguments into a single flag that loads an arbitrary LTO plugin dynamic library at link time. The Go command has been updated to disallow these risky linker flags and patterns to prevent exploitation.
CVE-2026-97038 is a vulnerability in the Go build process where malicious packages containing ".syso" files or cgo linker inputs can inject arbitrary linker flags or execute code at link time. This occurs because linker input files were passed to the external linker without proper validation, allowing execution of disguised linker scripts or injection of unallowlisted linker flags. The Go command now enforces validation to prevent these attacks.
A vulnerability in the Go compiler's handling of cgo linker flags could allow arbitrary code execution at link time. This occurs when malicious packages pass specially crafted linker script files via "#cgo LDFLAGS". The issue involves improper handling of split "-Wl," flags that consume a following argument, which could be interpreted as positional input files or linker scripts by the host linker, particularly GNU ld.bfd. The Go command now enforces stricter validation by requiring "-Wl," prefixes on certain flags, verifying that flags do not reference linker script files, and disallowing specific problematic flags.
A vulnerability in the Go toolchain allows a crafted ".syso" file to bypass cgo flag validation and inject arbitrary linker flags during linking. This occurs because the linker incorrectly parses certain ".syso" files as Go compiler objects, enabling untrusted cgo metadata directives to be passed to the external linker without validation. Additionally, long ".syso" filenames losing their extension and unrecognized formats forced external linking in pure-Go builds. The linker has been updated to reject unrecognized ".syso" files and preserve the ".syso" suffix when truncating archive member names.
A vulnerability in GCC's handling of cgo packages allows arbitrary command execution at link time via untrusted GCC spec files. This occurs when linking with certain flags (-fopenmp, -fopenacc, or -fsanitize=) that cause GCC to evaluate and include spec files from directories that may be untrusted. The Go toolchain now rejects directories containing such spec files and disallows certain flag prefixes to mitigate this risk.
A vulnerability exists in the use of Clang or GCC compilers when building malicious Go packages that use cgo. Malicious packages can exploit certain compiler and linker flags (-gen-* and -gnat*) in #cgo directives to cause unexpected code execution during build or write files to arbitrary directories. These flags were previously allowed due to wildcard matching in the allowlists, enabling attackers to write compilation database fragments and sidecar output files outside intended locations and to desynchronize flag argument parsing, potentially passing unvalidated inputs to the linker. The problematic flags are now disallowed in #cgo compiler and linker flags to mitigate this issue.
A vulnerability in the Go compiler's handling of "//go:cgo_*" directives allowed malicious packages to inject arbitrary flags into the external linker invocation on ELF platforms. This was due to the compiler and linker not rejecting commas in certain cgo directives, enabling crafted inputs to split linker flags and potentially alter symbol exports. The issue has been addressed by rejecting commas in these directives, changing how the linker passes dynamic linker paths, and preventing symbol overwrites between import and export directives.