MISP Guard, a security filter for MISP feed distribution, has a case-sensitivity flaw in multiple policy enforcement checks. This flaw allows attackers with event creation privileges to bypass configured allow/block lists by altering the letter case of taxonomy tags, attribute categories, or sharing-group UUIDs. As a result, unauthorized threat intelligence data may be disclosed to downstream consumers, violating confidentiality policies.
CVE-2026-115959 is a missing authorization vulnerability in the WPExperts APIExperts Square for WooCommerce plugin. Versions from initial release up to 4.7.5 are affected. The flaw allows exploitation due to incorrectly configured access control, potentially leading to unauthorized actions. The issue is fixed in version 4.7.6.
CVE-2026-115960 is a missing authorization vulnerability in the WPExperts APIExperts Square for WooCommerce plugin versions before 4.7.6. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized actions. The issue is fixed in version 4.7.6.
CVE-2026-115955 is a stored cross-site scripting (XSS) vulnerability in the bPlugins Advanced Post Block - Post Grid for WordPress block editor. It affects versions from initial release up to 2.5.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. A fix is available in version 2.5.2.
CVE-2026-115956 is a stored cross-site scripting (XSS) vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer affecting versions from initial through 1.8.3. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The issue is fixed in version 1.8.4.
CVE-2026-115961 is a stored cross-site scripting (XSS) vulnerability in bPlugins B Slider up to version 2.2.2. It involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to inject malicious scripts. The vulnerability is fixed in version 2.2.4.
CVE-2026-116257 is a vulnerability in BillaBear version 2025.01.03 affecting the Installation Handler component. Specifically, the processInstall function in src/BillaBear/Controller/InstallController.php lacks proper authentication, allowing remote attackers to exploit this flaw without credentials. The vulnerability has a medium severity score of 6.9 and has been publicly disclosed with available exploit information. The vendor has not responded to the disclosure, and no patch or remediation is currently documented.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.5.
Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42.
CVE-2026-115608 is a high-severity SQL Injection vulnerability in Crocoblock JetEngine versions prior to 3.9.0.1. It allows improper neutralization of special elements in SQL commands, potentially enabling an attacker with low privileges to execute unauthorized SQL queries. The vulnerability affects all versions from initial release up to 3.9.0 inclusive. A fix is available in version 3.9.0.1.
CVE-2026-115953 is a stored cross-site scripting (XSS) vulnerability in the Geo Mashup plugin developed by Dylan Kuhn. The flaw involves improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts. This vulnerability affects Geo Mashup versions from the initial release up to 1.13.22. A fix is available in version 1.13.23. The CVSS 3.1 base score is 6.5, indicating a medium severity level.
CVE-2026-115954 is a missing authorization vulnerability in Dylan Kuhn's Geo Mashup plugin affecting versions up to 1.13.22. The flaw allows exploitation due to incorrectly configured access control security levels. A fix is available in version 1.13.23. The vulnerability has a medium severity with a CVSS score of 5.4.
CVE-2026-115950 is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin Better Post & Filter Widgets for Elementor by WP Smart Widgets. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. Versions from initial release up to 1.9.1 are affected. The issue is fixed in version 1.9.2.
CVE-2026-115951 is a stored cross-site scripting (XSS) vulnerability in Kevin Weber's Lazy Load for Videos plugin affecting versions before 2.18.12. The flaw involves improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts that can be executed in the context of other users. This vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. The issue is fixed in version 2.18.12.
CVE-2026-111497, dubbed Node2Shell, is a critical out-of-bounds write vulnerability in Google’s Brotli decoder affecting versions 1.0.3 through 1.2.0. It impacts multiple platforms including Node.js, .NET, PowerShell, and Python packages, allowing unauthenticated attackers to cause memory corruption that can lead to process crashes, memory leaks, or arbitrary code execution. The flaw has been patched in Brotli versions 1.0.10, 1.1.1, and 1.2.1, with corresponding updates released by Microsoft, Node.js, and Python package maintainers. No exploitation in the wild has been reported, but proof-of-concept code demonstrates code execution on certain Linux arm64 Node.js builds. The vulnerability arises when attacker-controlled compressed data is processed by the affected Brotli decoder.
CVE-2026-116256 is a server-side request forgery (SSRF) vulnerability in the geesondog RhaPHP project affecting the image function in application/mp/controller/Show.php within the Mp Module Media Proxy component. The vulnerability allows remote attackers to manipulate the 'url' argument to induce SSRF. The product uses a rolling release model, so no specific affected or fixed versions are provided. The vendor did not respond to disclosure attempts. Public exploit code is available. The CVSS 4.0 base score is 6.9, indicating medium severity.
CVE-2026-115948 is a Blind SQL Injection vulnerability in David Lingren's Media Library Assistant affecting versions prior to 3.43. The flaw allows an attacker with low privileges to execute unauthorized SQL commands, potentially leading to high confidentiality impact and limited availability impact. A fix is available in version 3.43.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1.
Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through 2.8.2.