Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.
Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Improper Neutralization of Special
Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request
Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in
administrator into visiting a phishing website, causing the router to execute
arbitrary commands with root privileges.
Refer to the '
Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
An attacker URL (http://en2an.top/cleanfda/init.sh) was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-23. The URL is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen twice in attacker activity originating from infrastructure in China. This URL is linked to attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software versions or CVEs are associated with this indicator. No known exploits or threat actors have been confirmed in connection with this URL.
CVE-2026-63243 is an authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana devices (V2, V2X, SE). This flaw allows an attacker within Bluetooth range to connect to the affected device without prior pairing or authentication. The vulnerability affects version 1.30.260813.1100 of the product. The CVSS 3.1 base score is 4.3, indicating a medium severity issue with low attack complexity and no user interaction required. There is no indication of a patch or vendor advisory specifying remediation status. No known exploits are reported in the wild.
CVE-2026-55981 is a critical firmware verification vulnerability affecting Creative Labs Creative Sound Blaster Katana V2, V2X, and SE devices. The flaw allows an attacker to modify a legitimate firmware image and upload the altered firmware to the device without proper verification. This can lead to complete compromise of the device's confidentiality, integrity, and availability.
The Iranian state-sponsored APT group known as Prince of Persia resumed operations in 2026 after a three-month pause coinciding with the Iran-US-Israel conflict. The group deployed a new Tornado malware command-and-control (C&C) server hosted in the United States for the first time since 2016, using shared hosting services rather than virtual private servers. Prince of Persia targets Iranian dissidents and government and private entities in the US, Europe, and the Middle East. The group uses malware capable of stealing files via Telegram bots. Semperis researchers have shared indicators of compromise and recommend monitoring for related activity.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator.
This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution.
The Popup Builder WordPress plugin versions before 4.4.6 contain a vulnerability where authorization checks are not performed before trashing popup content during a maintenance routine triggered by unauthenticated requests. This flaw allows unauthenticated attackers to move popups into the Trash and overwrite their preview data.
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected.
The User Profile Builder WordPress plugin versions before 4.0.5 contain an authorization bypass vulnerability. This flaw allows an Administrator of a Multisite subsite to edit any user's account email via the front-end Edit Profile form without proper authorization checks. Exploiting this, an attacker can change the email of a Network Super Admin account and potentially take over that account through the password reset process.
The User Profile Builder WordPress plugin versions before 4.0.5 contain a vulnerability where one shortcode attribute is not properly sanitized and escaped before being output in a redirect message. This flaw allows users with contributor-level permissions to perform stored cross-site scripting (XSS) attacks against users with higher privileges who submit the affected form.
The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options.
The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).