The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.
WP Photo Album Plus plugin for WordPress versions up to 9.3.02.002 contains an authenticated command injection vulnerability via the 'value' parameter in the 'update-photo' AJAX action. This flaw arises from improper shell escaping in the wppa_image_magick_a() function, allowing attackers with the 'wppa_upload' capability to execute arbitrary OS commands as the web server user. Exploitation requires ImageMagick to be enabled on the server. The vulnerability enables full remote code execution and can affect users beyond administrators if the plugin's privilege settings are misconfigured.
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display_format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin's attribute display feature.
The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes (parsed to inject instance_id) + undeclared is_widget' parameter in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires setting the undeclared is_widget flag to '1' via block JSON, which activates the vulnerable code path that concatenates the attacker-controlled instance_id value into an unescaped HTML class attribute.
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.
The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.
The Lightweight Cookie Notice – Cookie Banner for Cookie Consent WordPress plugin up to version 1.19 contains a vulnerability due to a hardcoded security constant (W3TC_DYNAMIC_SECURITY) with a publicly known value. This exposure allows unauthenticated attackers to discover the W3 Total Cache mfunc security key, potentially enabling arbitrary PHP code injection if W3 Total Cache is also installed. The vulnerability is classified under CWE-330 for use of insufficiently random values.
The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php.
The Bulk Page Generator – LPagery WordPress plugin up to version 3.1.0 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can create, modify, and delete pages and bulk page-generation processes without proper authorization checks. On fresh installations without Freemius opted in, the AES-256-CBC key used for Bearer token validation defaults to a publicly known value, making token forgery trivial for any authenticated user.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.
FreeRDP versions from 3.29.0 up to but not including 3.32.0 contain an integer overflow vulnerability in the Apple audin backends. This flaw allows a malicious RDP server to cause a heap out-of-bounds write on macOS and iOS clients by sending a specially crafted FramesPerPacket value that wraps the buffer size calculation. The issue is fixed in version 3.32.0.
A heap-based out-of-bounds write vulnerability exists in libmodplug through version 0.8.9.1, specifically in the CSoundFile::ReadDSM() function. The flaw arises because the variable nPat is not validated against the maximum allowed patterns (MAX_PATTERNS). An attacker can exploit this by supplying a crafted DSM file with more than 240 PATT chunks or a wrapping patt_len value, leading to heap memory corruption and potential process crash.
DragonflyDB versions up to 2.0.2 have a vulnerability where unauthenticated clients can cause unbounded memory allocation by passing a negative COUNT parameter to certain commands (HRANDFIELD, ZRANDMEMBER, SRANDMEMBER). This can lead to memory exhaustion and trigger the operating system's out-of-memory (OOM) killer, terminating the Dragonfly instance and disrupting service for all clients.
CVE-2026-111275 is a medium severity stack-based out-of-bounds read and write vulnerability in the NIFTI-Imaging nifti_clib library up to version 3.0.1. The flaw exists in the nifti_convert_n2hdr2nim() function, where the NIfTI-2 dim[0] value is not range-checked. This allows an attacker to supply a crafted 540-byte NIfTI-2 header via nifti_image_read(), potentially causing application crashes or stack memory corruption.
A heap out-of-bounds read vulnerability exists in libewf through version 20260924 in the function libewf_lef_extended_attribute_read_data(). This occurs because UTF-16 name and value sizes are validated before being doubled, allowing attackers to craft .L01/.Lx01 files with oversized extended attribute metadata counts. Exploitation can cause application crashes or leakage of uninitialized heap memory.
SoX versions through 14.4.2 contain a heap out-of-bounds write vulnerability in the function lsx_ms_adpcm_block_expand_i() within src/adpcm.c. This flaw is triggered by an unusual samplesPerBlock value in the WAV format chunk. An attacker can exploit this by supplying a crafted MS ADPCM WAV file to SoX or any application using libsox, causing a partially controlled 16-bit sample to be written beyond the allocated heap buffer.
Libyal libesedb versions up to 20260704 contain a heap out-of-bounds read vulnerability in the function libesedb_record_get_multi_value(). This flaw allows attackers to read beyond allocated buffers by exploiting unbounded multi-value offset tables. A crafted ESE/EDB database processed by the esedbexport tool can cause the application to crash or expose approximately 32 KiB of adjacent heap memory. The vulnerability has a CVSS score of 6.1, indicating medium severity, with local attack vector and user interaction required.
libregf versions up to 20260526 contain a heap out-of-bounds read vulnerability in the function libregf_value_item_read_value_data(). This occurs because the code incorrectly bounds the value data size without subtracting a 4-byte old-format cell offset. An attacker can exploit this by supplying a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin, potentially leaking adjacent heap memory or causing crashes in parsers such as regfexport and plaso.