The Advanced Form Integration — Connect Forms to 300+ Apps WordPress plugin up to version 2.10.2 is vulnerable to PHP Object Injection via deserialization of untrusted input. Exploitation requires an administrator to have configured at least one active NexForms integration. No direct impact occurs unless another plugin or theme with a PHP Object Injection POP chain is present, which could then enable actions like arbitrary file deletion, data retrieval, or code execution. The vulnerability affects versions up to and including 2.10.2 and has a high severity CVSS score of 8.1.
The dsh-notify-focus npm package contains malicious code that fully compromises any computer on which it is installed or running. Removal of the package does not guarantee elimination of all malicious software installed as a result. Immediate rotation of all secrets and keys stored on the affected computer is strongly advised.
CVE-2026-123957 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setIpQosRules function within the /cgi-bin/cstecgi.cgi file, where manipulation of the ipStart argument can cause a buffer overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code has been disclosed, increasing the risk of exploitation.
The pulumi-doppler package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
CVE-2026-123881 is a medium severity vulnerability in OpenBMB Internet of Agents affecting the fetch_chat_record function in the Message Handler component. Improper access controls on the comm_id argument allow remote attackers to potentially access unauthorized chat records. The vulnerability has been publicly disclosed with exploit code available, but the vendor has not yet responded or issued a fix.
The aBlocks WordPress plugin up to version 2.18.0 contains a stored cross-site scripting (XSS) vulnerability via the 'headingTag' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress versions up to and including 3.3.8 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of certain parameters, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages.
The Strong Testimonials WordPress plugin up to version 3.3.16 is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the 'star_rating' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator previews a pending testimonial, a step common in the plugin's moderation process.
The aBlocks – Gutenberg Blocks plugin for WordPress up to version 2.18.0 contains a vulnerability that allows authenticated users with contributor-level access or higher to expose the full rendered content of any password-protected post by using a shortcode with the post's ID. Users with author-level access or higher can publish posts embedding this shortcode, which exposes the protected content to unauthenticated visitors.
The GamiPress – Gamification plugin for WordPress, including its AI integration, is vulnerable to an SQL Injection flaw in all versions up to and including 8.1.1. This vulnerability arises from insufficient escaping of the 'input_<field_id>.<part>' parameter used in Gravity Forms integration, allowing authenticated users with subscriber-level access or higher to inject additional SQL queries. Exploitation requires a configured GamiPress achievement tied to a Gravity Forms field value submission event with the form published, which is a common setup for sites using this integration.
The WebToffee WP Backup and Migration WordPress plugin up to version 1.6.1 contains a SQL Injection vulnerability via the 'description' parameter. Authenticated users with subscriber-level access or higher can inject SQL code due to insufficient input escaping. Exploitation requires an administrator to perform a local database export and restore operation, which is the plugin's primary function, to trigger the vulnerability. This vulnerability can lead to unauthorized disclosure of sensitive database information. The CVSS score is 5.7, indicating a medium severity risk.
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps WordPress plugin versions up to 5.5.90 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient sanitization and escaping of text-based database column values rendered in a textarea element, allowing authenticated users with Subscriber-level access or higher to inject malicious scripts. These scripts execute when any user views the affected page.
The Vanquish Upload Files for WooCommerce WordPress plugin is vulnerable to a directory traversal flaw in all versions up to and including 2.7.13. Authenticated users with subscriber-level access or higher can exploit this vulnerability via the 'vanupfi_file_name' parameter to read arbitrary files on the server. The flaw arises from an authorization bypass triggered by supplying a non-existent order ID, which causes a key permission check to be skipped. Additionally, a loose substring match allows traversal payloads to be streamed directly, potentially exposing sensitive files such as wp-config.php.
A stored cross-site scripting (XSS) vulnerability exists in the AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia WordPress plugin. The flaw is due to insufficient input sanitization and output escaping of the 'zipcode' parameter in all versions up to and including 9.2.41. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages.
The QA Assistants – Driven by data WordPress plugin up to version 5.3.0 is vulnerable to PHP Object Injection via the 'dlevent_ver' parameter. This vulnerability arises from unsafe deserialization without class restrictions and insufficient sanitization of input parameters, enabling unauthenticated attackers to inject malicious PHP objects. Exploitation involves triggering a scheduled event that automatically runs every two minutes without authentication, potentially leading to arbitrary file writes and remote code execution.
A stored cross-site scripting (XSS) vulnerability exists in the WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps WordPress plugin up to version 5.5.89. The flaw arises from insufficient input sanitization and output escaping of the 'ImageURL column value' parameter, which can be exploited by authenticated users with subscriber-level access or higher. Exploitation requires an administrator to publish a DataTables shortcode over a database column controlled by the attacker with the Image URL media type assigned, a feature not enabled by default.
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps WordPress plugin is vulnerable to SQL Injection via the 'engine' parameter in versions up to and including 5.5.90. Authenticated users with subscriber-level access or higher can exploit this vulnerability if an administrator has configured a Data Project page to allow lower-privileged roles. The flaw arises from insufficient escaping and lack of proper preparation of the SQL query, enabling attackers to append additional SQL commands to extract sensitive database information.
The Paystack WooCommerce Payment Gateway plugin for WordPress versions up to 5.8.5 contains a vulnerability that allows unauthenticated attackers to access sensitive customer information. This occurs via the 'key' parameter when the optional custom metadata feature is enabled, enabling enumeration of sequential order IDs to extract personally identifiable information (PII) embedded in page HTML.
A stored cross-site scripting (XSS) vulnerability exists in the Ultimate Member WordPress plugin up to version 2.14.1. The flaw is due to insufficient input sanitization and output escaping of the 'pm_note' parameter, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when a privileged user views the injected profile page and interacts with a crafted element. The vulnerability has a CVSS score of 6.4, indicating a medium severity risk.
The WP Data Access plugin for WordPress versions up to and including 5.5.89 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient output escaping in the autocomplete lookup label of the Simple Form feature. Authenticated users with Subscriber-level access or higher who can edit lookup rows via legacy forms can inject malicious scripts. These scripts execute when any user, including higher-privileged users, accesses the affected page, potentially compromising user sessions or data.