NI vulnerabilities and threats

CVE-2026-101889 is a path traversal vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows authenticated administrators to delete arbitrary directories by importing a crafted package with manipulated configuration values. This can lead to deletion of critical WordPress directories such as wp-admin, potentially rendering the site inoperable.

CVE-2026-101888 is a path traversal vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows authenticated administrators to write arbitrary files outside the intended extraction directory during ZIP import. This can lead to remote code execution if malicious files are processed by the web environment.

Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.

CVE-2026-103345 is a medium severity vulnerability in Shamim Rajani's Pie Register plugin that allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. It affects versions from initial releases up to 3.8.4.13 inclusive.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a through 6.2.14.

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2.

Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through 6.2.14.

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that the site owner has enabled the plugin's User Level Permissions for the Subscriber role, as this grants access to the i_saw_this_noti AJAX branch needed to deliver the payload.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.

The Social Media Share Buttons & Social Sharing Icons WordPress plugin up to version 3.0.1 is vulnerable to reflected cross-site scripting (XSS) via URL parameters. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user accesses a crafted page and clicks the WeChat share icon on a mobile device. The vulnerability arises from insufficient input sanitization and output escaping.

A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely

An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force the creation of an OS account by manipulating the permission column during CSV bulk user registration

An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL PNS allows an attacker to upload a dangerous file that is not an official patch

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter.

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions

Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.

Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.

Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.