CVE-2026-125767 is a vulnerability in NerdPress Hubbub Lite social-pug that allows insertion of sensitive information into sent data, potentially enabling retrieval of embedded sensitive data. This issue affects versions from initial releases up to 1.36.3.1. A fix is available in version 1.36.3.2. The vulnerability has a medium severity with a CVSS score of 5.3.
Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.This issue affects WPZOOM Social Feed Widget & Block: from n/a through 2.4.1.
Apache Roller versions 4.0 through 6.1.6 are affected by a deserialization of untrusted data vulnerability (CWE-502). This occurs when the XML-RPC client in Roller deserializes Java object data from a weblog update ping response, allowing an attacker controlling that response to execute code within the Roller server process. The issue is resolved in version 6.1.7, which removes the unsafe deserialization.
CVE-2026-123480 is a stored cross-site scripting (XSS) vulnerability in the Fullworks Plugins Display Eventbrite Events widget-for-eventbrite-api. It affects versions from initial release up to 6.9.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. A fix is available in version 6.9.2.
Apache Roller versions 4.0 through 6.1.6 contain a missing authorization vulnerability that allows weblog members with a Limited role to modify or remove entries they should only be able to read, including entries published by other members. This occurs because the entry editor verifies the member's weblog role but does not check if that role permits modification of the specific entry. Users are advised to upgrade to version 6.1.7 or later to address this issue.
CVE-2026-125448 is a missing authorization vulnerability in Kali Forms (Kaliforms) affecting versions from initial up to 2.4.31. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The issue is fixed in version 2.4.32.
CVE-2026-118414 is a cross-site scripting (XSS) vulnerability in Apache Roller versions 6.1.2 through 6.1.6. It allows a weblog administrator to store malicious script code that executes in the browsers of weblog members when they open their main menu. The issue arises because the HTML-stripping routine fails to close a tag properly, and the weblog description is rendered without escaping, enabling script injection. Users are advised to upgrade to Apache Roller 6.1.7 or later to address this vulnerability.
CVE-2026-118413 is a cross-site scripting (XSS) vulnerability in Apache Roller versions 4.0 through 6.1.6. The flaw allows a weblog administrator to store malicious scripts via blogroll links imported from OPML files, which are not properly sanitized or escaped in the default theme. This can lead to script execution in the browsers of weblog visitors. The issue is fixed in Apache Roller 6.1.7 and later, which restricts imported links to web links only and escapes them on output.
CVE-2026-123481 is a missing authorization vulnerability in The Ultimate WordPress Toolkit – WP Extended plugin versions before 3.4.3. This flaw allows attackers with limited privileges to exploit improperly configured access control, potentially gaining unauthorized access to certain functions. The vulnerability has a medium severity rating with a CVSS score of 4.3. A fix is available in version 3.4.3.
Apache Roller versions 5.1.0 through 6.1.6 have an improper authentication vulnerability in the OpenID sign-in path. This flaw allows users whose accounts have been disabled by an administrator to sign in again via OpenID and access unpublished entries. The issue affects only sites that have enabled the non-default OpenID authentication mode. Apache Roller 6.1.7 and later versions have removed OpenID 2.0 and are not affected.
CVE-2026-125763 is a missing authorization vulnerability in Brainstorm Force SureForms versions prior to 2.13.1. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The issue is fixed in version 2.13.1.
Apache Roller versions 5.0.1 through 6.1.6 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw that allows an unauthenticated attacker to create an administrator account if a logged-in administrator visits a malicious link. The vulnerability arises because the request-token check was only applied to POST requests, while administrative actions also accepted GET requests. This issue is fixed in Apache Roller 6.1.7 and later, which require POST requests with a valid token for data-changing actions.
CVE-2026-125743 is a stored cross-site scripting (XSS) vulnerability in the WPVibes Elementor Addon Elements plugin for WordPress. It affects versions from initial releases up to, but not including, version 1.5.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of other users. A fix is available in version 1.5.1.
CVE-2026-118410 is a vulnerability in Apache Roller versions 4.0 through 6.1.6 where an unauthenticated visitor can read blog entries that have been withdrawn to draft status via the AtomPub API. Although the entry is removed from the weblog, it remains in the search index and is publicly accessible through search results. AtomPub is disabled by default. Upgrading to Apache Roller 6.1.7 or later mitigates this issue by ensuring only published entries appear in search results.
CVE-2026-118409 is a vulnerability in Apache Roller versions 4.0 through 6.1.6 that allows unauthenticated visitors to recover email addresses of commenters. This occurs because the search index stored commenter email addresses and the public weblog search accepted queries on that field, including wildcard queries that could confirm email addresses one character at a time. The vulnerability is addressed in Apache Roller 6.1.7 and later versions.
CVE-2026-125436 is a missing authorization vulnerability in Mamunur Rashid's The Post Grid plugin, affecting versions prior to 7.9.10. This flaw allows exploitation due to incorrectly configured access control security levels. The issue has a medium severity with a CVSS score of 4.3 and impacts confidentiality but not integrity or availability. A fix is available in version 7.9.10.
Apache Roller versions 4.0 through 6.1.6 contain a missing authorization vulnerability that allows any logged-in user to read unpublished weblog entries for which they have no assigned role. The vulnerability arises because the entry preview function only verifies that the user is logged in, not whether they have permission to view the specific weblog entry. Exploitation requires knowledge of the weblog name and the entry's link name. Upgrading to version 6.1.7 or later mitigates this issue by enforcing role-based access for entry previews.
CVE-2026-111824 is a cross-site scripting (XSS) vulnerability in Apache Roller 6.1.6. It allows an authenticated user with the Author role on a weblog using a custom theme to store malicious script that executes in the browsers of users who open the affected resource URL. The issue arises because media files uploaded with a user-chosen path were served with a content type based on that path, bypassing previous fixes that restricted media serving rules. Media uploads are disabled by default. Upgrading to Apache Roller 6.1.7 or later mitigates this vulnerability by enforcing consistent media serving rules and disallowing user-supplied paths in uploads.
CVE-2026-125433 is a stored cross-site scripting (XSS) vulnerability in the Futurio Extra plugin by FuturioWP. It affects versions from initial release up to 2.0.25. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts that execute in the context of other users. A fix is available in version 2.0.26.
CVE-2026-108338 is a cross-site scripting (XSS) vulnerability in Apache Roller versions 5.0.1 through 6.1.6. It allows an authenticated user with the Author role to inject script code into weblog entry tags via AtomPub. The vulnerability arises because HTML characters in tag names are not properly neutralized, and certain themes and macros render these tags without escaping, causing script execution in viewers' browsers. AtomPub is disabled by default, and the issue is mitigated in Apache Roller 6.1.7 and later, which removes HTML characters from tag names.