The Automated Import Products to Cart WordPress plugin before version 1.0.4 contains a path traversal vulnerability that allows users with minimal permissions, such as subscribers, to read and delete arbitrary files on the server. This occurs because the plugin does not properly sanitize user-supplied file paths before using them for file operations.
The LogixFast Auth WordPress plugin versions before 1.0.4 contain a vulnerability in the password reset functionality. The plugin sends the password-reset one-time code to the email address supplied in the request rather than the email address associated with the user account. This flaw allows unauthenticated attackers to reset any user's password, including administrators, leading to account takeover.
The Enable SVG, WebP, and ICO Upload WordPress plugin before version 1.1.6 contains a stored cross-site scripting (XSS) vulnerability. This occurs because the plugin does not properly sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images. Users with author role or higher privileges can exploit this flaw to perform stored XSS attacks.
The Contact Form by Supsystic WordPress plugin before version 1.11.1 contains a server-side template injection vulnerability. This flaw allows an administrator to inject and execute arbitrary code on the server via the form template engine. The injected code executes whenever a visitor loads a page with the vulnerable form, enabling unauthenticated visitors to potentially read sensitive server-side information such as authentication salts and database credentials.
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish WordPress plugin versions up to 4.1.12 contains a SQL Injection vulnerability via the 'exclude_posts' parameter. This flaw allows unauthenticated attackers to inject arbitrary SQL queries due to insufficient input escaping and query preparation. Additionally, the HMAC authentication protecting the endpoint can be bypassed on fresh installations before the administrator visits the settings page, as the secret key is not yet generated, enabling attackers to compute valid tokens. The vulnerability has a high severity score of 7.5 CVSS v3.1.
CVE-2026-42949 is an authorization bypass vulnerability in the /api/runscript endpoint of Frangoteam's FUXA product version 1.3.2-2809. This flaw allows an unauthenticated attacker to execute privileged operations by sending a specially crafted HTTP request. The vulnerability has a medium severity rating with a CVSS score of 5.6.
CVE-2026-40063 is an information disclosure vulnerability in the /nodered/fuxa/scripts functionality of Frangoteam's FUXA product version 1.3.2-2809. An unauthenticated attacker can send a specially crafted HTTP request to trigger this flaw and leak sensitive information.
CVE-2026-42922 is a critical authorization bypass vulnerability in the /nodered functionality of Frangoteam FUXA version 1.3.2-2809. This flaw allows an unauthenticated attacker to send a specially crafted HTTP request that can lead to arbitrary code execution on the affected system.
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.
A critical vulnerability exists in D-Link DIR-505 version 1.10B02 in the Web Management CGI component. The flaw is in the main function of the /secmark1524.cgi file, where manipulation of certain arguments can create a backdoor. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of attacks.
Volmarg Personal Management System versions up to 2.1.0 contain an OS command injection vulnerability. Authenticated users can exploit this flaw by creating directories with shell metacharacters in the upload/files path and then moving or copying them, resulting in arbitrary shell command execution as the web server user.
PiWeb Disable payment method / Partial payment for WooCommerce versions before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler. This flaw allows unauthenticated attackers to modify and read other customers' orders by reusing a nonce from their own order-pay page and supplying sequential order_id values. The vulnerability enables attackers to change payment methods, recalculate fees, and disclose order details such as line items and totals.
DB Tools versions compiled with Golang 1.26.8 rely on a TLS implementation that does not include an internal denylist for certain known-bad CA certificates, specifically the eMudhra certificates. This issue is addressed in Golang 1.27.3, which adds these certificates to the denylist. DB Tools version 100.20.0 updates to Golang 1.27.3 to resolve this vulnerability.
CVE-2026-118590 is a medium severity vulnerability in the nipy nibabel library versions 5.4.0, 5.4.1, and 5.4.2. It involves uncontrolled memory allocation in the array_from_file function within nibabel/volumeutils.py, which can be triggered remotely. A fix has been proposed but is not yet accepted.