The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.
The Otter Blocks WordPress plugin versions before 3.2.8 contains a vulnerability where a pattern used to rewrite dynamic-content tokens is not properly bounded. This flaw allows the pattern to consume the quote closing an HTML attribute and incorporate adjacent unescaped data as new attributes. As a result, unauthenticated users can perform stored Cross-Site Scripting (XSS) attacks that execute in the browsers of any visitors viewing the affected page, including logged-in administrators.
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
The Otter Blocks WordPress plugin versions before 3.2.8 improperly handle access control for post data via a REST API endpoint. It treats any post with published status as publicly readable, allowing unauthenticated users to access manual excerpts of password-protected posts, content and titles of non-public post types, and on WooCommerce sites, coupon codes and their descriptions. This vulnerability can lead to unauthorized information disclosure.
The Otter Blocks WordPress plugin versions before 3.2.8 contain a vulnerability where user-supplied block styling values are not properly sanitized and escaped before being written into inline stylesheets. This flaw allows users with contributor-level access or higher to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post. The vulnerability is identified as CVE-2026-109933 and has a CVSS score of 6.8, indicating a medium severity level.
CVE-2026-107858 is a high-severity vulnerability in Google Agent Development Kit (ADK) for Java versions before 1.13.0. It involves missing origin validation in WebSockets and permissive cross-domain policies, allowing remote attackers to control a locally running agent via malicious web pages. The vulnerability affects the /run_live WebSocket endpoint and REST API, which accept connections and requests from any origin by default. This enables cross-origin attacks that can trigger tools, stream responses, and manipulate sessions and artifacts. The issue is fixed in version 1.13.0 by enforcing same-origin policies and rejecting DNS-rebinding requests over loopback.
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires user registration to be open on the site, and script execution is triggered when an Administrator subsequently runs the plugin's user-spam scan and views the resulting Non-checkable users or Spam users tab — the plugin's own documented workflow.
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
Part-DB-server versions prior to 2.13.3 contain a vulnerability in the password recovery mechanism where the reset link URL is constructed from an unvalidated client-supplied Host header. This allows an unauthenticated attacker to craft a password reset email with a malicious hostname embedding a valid reset token. When the victim clicks the link, the attacker can capture the token and use it to reset the victim's password, including the seeded admin account, resulting in full administrative takeover. The issue is patched in version 2.13.3.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.
Part-DB-server versions prior to 2.13.2 contain a vulnerability where authenticated API users can bypass the configured maximum attachment file size by uploading base64-encoded files through the API. This bypass allows uploading files larger than the intended limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.
Part-DB-server versions prior to 2.13.2 contain a vulnerability that allows authenticated users to bypass the maximum attachment file size limit when using the server-side 'Download external file' feature. This can lead to uncontrolled resource consumption by storing files larger than the configured limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.
Part-DB-server versions prior to 2.12.3 contain a cross-site scripting (XSS) vulnerability due to improper sanitization of SVG files. The server relies on the file extension rather than actual content type to sanitize SVG uploads, allowing authenticated attackers to upload malicious SVG files with JavaScript payloads using non-SVG extensions. When users view these attachments inline, the embedded script executes in the context of the Part-DB origin. This vulnerability has been fixed in version 2.12.3.
Part-DB-server versions prior to 2.12.2 contain a stored cross-site scripting (XSS) vulnerability. This occurs because user-controlled Part names are rendered using Twig's |raw filter without proper neutralization, allowing injection of arbitrary HTML elements into the BOM validation result page. Although JavaScript execution is blocked by the Content Security Policy, attackers can still inject HTML links, forms, images, and CSS UI elements. The vulnerability is fixed in version 2.12.2.
Part-DB-server versions prior to 2.12.1 contain a hard-coded APP_SECRET value in the .env file committed to the public repository. This secret is used by the Symfony framework to sign remember-me cookies. Because the official Docker image does not override or randomize this secret at startup, an attacker who obtains it can forge authenticated sessions without credentials. This vulnerability has been fixed in version 2.12.1.
CVE-2026-54630 is a critical vulnerability in Part-DB-server prior to version 2.12.1 that allows authenticated users with default user privileges to upload .phar files to a web-accessible directory. The upload handler fails to block .phar extensions, which are executed as PHP due to the default Apache configuration routing .phar files to PHP-FPM. This leads to remote code execution as the web server user. The issue is patched in version 2.12.1.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element — a part Parameter, Attachment, PartLot, Orderdetail, etc. — all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element's history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1.