The User Profile Builder WordPress plugin versions before 4.0.5 contain an authorization bypass vulnerability. This flaw allows an Administrator of a Multisite subsite to edit any user's account email via the front-end Edit Profile form without proper authorization checks. Exploiting this, an attacker can change the email of a Network Super Admin account and potentially take over that account through the password reset process.
The User Profile Builder WordPress plugin versions before 4.0.5 contain a vulnerability where one shortcode attribute is not properly sanitized and escaped before being output in a redirect message. This flaw allows users with contributor-level permissions to perform stored cross-site scripting (XSS) attacks against users with higher privileges who submit the affected form.
The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options.
The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.
The Otter Blocks WordPress plugin versions before 3.2.8 contains a vulnerability where a pattern used to rewrite dynamic-content tokens is not properly bounded. This flaw allows the pattern to consume the quote closing an HTML attribute and incorporate adjacent unescaped data as new attributes. As a result, unauthenticated users can perform stored Cross-Site Scripting (XSS) attacks that execute in the browsers of any visitors viewing the affected page, including logged-in administrators.
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
The Otter Blocks WordPress plugin versions before 3.2.8 improperly handle access control for post data via a REST API endpoint. It treats any post with published status as publicly readable, allowing unauthenticated users to access manual excerpts of password-protected posts, content and titles of non-public post types, and on WooCommerce sites, coupon codes and their descriptions. This vulnerability can lead to unauthorized information disclosure.
The Otter Blocks WordPress plugin versions before 3.2.8 contain a vulnerability where user-supplied block styling values are not properly sanitized and escaped before being written into inline stylesheets. This flaw allows users with contributor-level access or higher to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post. The vulnerability is identified as CVE-2026-109933 and has a CVSS score of 6.8, indicating a medium severity level.
CVE-2026-107858 is a high-severity vulnerability in Google Agent Development Kit (ADK) for Java versions before 1.13.0. It involves missing origin validation in WebSockets and permissive cross-domain policies, allowing remote attackers to control a locally running agent via malicious web pages. The vulnerability affects the /run_live WebSocket endpoint and REST API, which accept connections and requests from any origin by default. This enables cross-origin attacks that can trigger tools, stream responses, and manipulate sessions and artifacts. The issue is fixed in version 1.13.0 by enforcing same-origin policies and rejecting DNS-rebinding requests over loopback.
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires user registration to be open on the site, and script execution is triggered when an Administrator subsequently runs the plugin's user-spam scan and views the resulting Non-checkable users or Spam users tab — the plugin's own documented workflow.
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
Part-DB-server versions prior to 2.13.3 contain a vulnerability in the password recovery mechanism where the reset link URL is constructed from an unvalidated client-supplied Host header. This allows an unauthenticated attacker to craft a password reset email with a malicious hostname embedding a valid reset token. When the victim clicks the link, the attacker can capture the token and use it to reset the victim's password, including the seeded admin account, resulting in full administrative takeover. The issue is patched in version 2.13.3.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.
Part-DB-server versions prior to 2.13.2 contain a vulnerability where authenticated API users can bypass the configured maximum attachment file size by uploading base64-encoded files through the API. This bypass allows uploading files larger than the intended limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.
Part-DB-server versions prior to 2.13.2 contain a vulnerability that allows authenticated users to bypass the maximum attachment file size limit when using the server-side 'Download external file' feature. This can lead to uncontrolled resource consumption by storing files larger than the configured limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.
Part-DB-server versions prior to 2.12.3 contain a cross-site scripting (XSS) vulnerability due to improper sanitization of SVG files. The server relies on the file extension rather than actual content type to sanitize SVG uploads, allowing authenticated attackers to upload malicious SVG files with JavaScript payloads using non-SVG extensions. When users view these attachments inline, the embedded script executes in the context of the Part-DB origin. This vulnerability has been fixed in version 2.12.3.
Part-DB-server versions prior to 2.12.2 contain a stored cross-site scripting (XSS) vulnerability. This occurs because user-controlled Part names are rendered using Twig's |raw filter without proper neutralization, allowing injection of arbitrary HTML elements into the BOM validation result page. Although JavaScript execution is blocked by the Content Security Policy, attackers can still inject HTML links, forms, images, and CSS UI elements. The vulnerability is fixed in version 2.12.2.