Threats affecting pkg:generic/radare2

CVE-2026-119490 is a cross-site scripting (XSS) vulnerability in the Better Notifications for WP plugin by Made with Fuel Ltd. The flaw involves improper neutralization of script-related HTML tags, allowing code injection. It affects versions from initial releases up to 1.10.1. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 1.10.2.

Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.2.2.

CVE-2026-119500 is a stored cross-site scripting (XSS) vulnerability in bPlugins Flash & HTML5 Video html5-video-player versions prior to 2.14.2. The flaw involves improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. This vulnerability has a CVSS score of 6.5, indicating a medium severity level. A fix is available in version 2.14.2.

CVE-2026-120840 is a missing authorization vulnerability in the ThemeGrill User Registration plugin affecting versions prior to 5.3.1. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue has a medium severity rating and a CVSS score of 4.3. A fix is available in version 5.3.1.

CVE-2026-120842 is a missing authorization vulnerability in Brainstorm Force SureForms versions prior to 2.13.1. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The issue has a medium severity rating with a CVSS score of 5.3 and does not impact confidentiality or availability but affects integrity. A fix is available in version 2.13.1.

CVE-2026-119520 is a stored cross-site scripting (XSS) vulnerability in Brainstorm Force Spectra (ultimate-addons-for-gutenberg) affecting versions from initial release up to 2.20.4. It involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 2.20.5.

CVE-2026-119494 is a medium severity vulnerability in Gemini Labs Site Reviews (versions before 8.3.7) that allows code injection via improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) flaw. The issue is fixed in version 8.3.7.

CVE-2026-120850 is a stored cross-site scripting (XSS) vulnerability in Elementor Website Builder affecting versions prior to 4.3.6. The flaw involves improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts that execute in the context of other users. This vulnerability has a medium severity rating with a CVSS score of 6.5. A fix is available in version 4.3.6.

CVE-2026-119493 is a stored cross-site scripting (XSS) vulnerability in Ditty by Metaphor Creations, LLC. It affects versions from initial releases up to 3.1.71. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 3.1.72.

CVE-2026-123960 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setWanConfig function of the /cgi-bin/cstecgi.cgi file, where manipulation of the pppoeUser, priDns, or secDns arguments can trigger the overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code is available, increasing the risk of attacks.

CVE-2026-123959 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setLanguageCfg function within the /cgi-bin/cstecgi.cgi file, where manipulation of the langType argument can cause a buffer overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code has been released, increasing the risk of attacks.

CVE-2026-119507 is a medium severity vulnerability in WPDeveloper's NotificationX plugin that allows improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) issue. This affects NotificationX versions prior to 3.3.7. The vulnerability permits code injection but does not impact integrity or availability. A fix is available in version 3.3.7.

A critical buffer overflow vulnerability exists in TOTOLINK CA300-PoE version 6.2c.884 in the setIpQosRules function of /cgi-bin/cstecgi.cgi. The vulnerability is triggered by manipulation of the ipStart argument and can be exploited remotely without user interaction. Public exploit code has been disclosed.

A missing authorization vulnerability exists in WC Lovers WCFM Marketplace (wc-multivendor-marketplace) up to version 3.8.3. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a CVSS score of 4.3, indicating medium severity, with impact limited to integrity without affecting confidentiality or availability. No patch or official fix information is provided at this time.

A missing authorization vulnerability exists in WP ManageNinja LLC Fluent Booking plugin versions up to 2.5.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A stored cross-site scripting (XSS) vulnerability exists in WC Lovers WCFM Marketplace plugin versions up to and including 3.8.3. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Suplugins Superb Addons: Blocks, Patterns & Theme Designer up to version 4.2.4. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The flaw affects versions through 4.2.4, and no patch or remediation details are provided in the available data.

A vulnerability in YITH WooCommerce Subscription (up to version 4.22.0) allows unauthorized parties to retrieve embedded sensitive system information. This exposure could lead to information disclosure without requiring user interaction or privileges.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Wpmet Wp Social plugin (wp-social) affecting versions up to 3.2.3. This vulnerability allows an attacker to trick an authenticated user into submitting unwanted requests, potentially leading to unauthorized actions with limited impact on confidentiality and integrity but no impact on availability.

A missing authorization vulnerability exists in ThimPress LearnPress up to version 4.4.12. This flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized information disclosure and modification. The vulnerability has a medium severity rating with a CVSS score of 5.4.