The Booking for Appointments and Events Calendar – Amelia plugin for WordPress versions up to 2.4.12 is vulnerable to sensitive information exposure via the 'page' parameter. This vulnerability allows unauthenticated attackers to access personally identifiable information of staff members, including full name, email, phone number, gender, and timezone, as well as internal notes authored by administrators for published events. The sensitive data is exposed because the raw providers array is included in the JSON response without proper filtering.
The Acadlix LMS WordPress plugin up to version 1.1.9 contains an arbitrary file deletion vulnerability due to insufficient file path validation in a specific function. This flaw allows attackers with subscriber-level access or higher to delete arbitrary files on the server. The vulnerability is exacerbated by weak authentication controls, effectively allowing unauthenticated exploitation. Deleting critical files like wp-config.php can lead to remote code execution.
The All in One SEO – AI SEO Plugin for WordPress up to version 5.0.3 is vulnerable to sensitive information exposure via the 's' parameter. This vulnerability allows unauthenticated attackers to retrieve arbitrary non-public post meta values, including sensitive custom fields such as API keys and internal notes. These values are exposed verbatim in the HTML title element and JSON-LD SearchResultsPage schema, potentially leaking confidential information.
A vulnerability in konflux-ci's Continuous Integration automation scripts causes sensitive GitHub access tokens to be stored in plaintext on the runner without cleanup after execution. A local attacker with access to the CI environment can read these tokens and gain unauthorized repository access, potentially modifying source code or release artifacts. Exploitation requires prior code execution access on the CI runner. No effective mitigation or patch is currently available according to the vendor advisory.
CVE-2026-116086 is a vulnerability in konflux-ci where an attacker with permission to trigger automated workflow runs can cause information disclosure. The flaw arises because user-supplied issue titles are incorporated directly into data queries without proper sanitization, enabling injection of malicious filter commands. This can expose sensitive information such as API credentials, deployment keys, and internal notes in workflow logs. The impact is limited to information disclosure within CI pipeline logs and does not allow direct code execution or cluster compromise. No patch or mitigation meeting Red Hat's criteria is currently available.
The Smart Post WordPress plugin versions up to 4.0.9 are vulnerable to stored cross-site scripting (XSS) via the 'display_name' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users interact with certain page elements. Exploitation requires a page containing an Author Filter block alongside a grid or live-filter block, with script execution triggered by clicking the attacker's author entry in the dropdown filter.
The FeedWordPress plugin for WordPress versions up to and including 2026.0517 is vulnerable to stored cross-site scripting (XSS) via syndicated RSS/Atom feed content. The vulnerability arises because the plugin's content sanitization function only removes the 'target' attribute and does not strip potentially dangerous 'style' or event-handler attributes. Additionally, the plugin disables WordPress's default content filters before saving imported feed items, allowing unauthenticated attackers controlling an external feed to inject malicious scripts that execute when users view the injected content.
The Uncanny Toolkit for LearnDash WordPress plugin versions up to and including 3.8.2 contains an authentication bypass vulnerability via the email parameter in the uo_login_action() function. This flaw allows attackers to bypass account verification and suspension controls by exploiting inconsistent input sanitization between user lookup and authentication. Attackers with valid credentials for unverified or suspended accounts can obtain a valid session cookie without proper approval. The required nonce for exploitation is publicly accessible, making the attack trivial for anyone with network access and knowledge of the target credentials.
The Newsletters plugin for WordPress up to version 4.18.1 is vulnerable to a time-based SQL Injection via the 'id' parameter. This vulnerability arises from insufficient escaping and lack of proper preparation of the SQL query involving user-supplied input. Authenticated attackers with subscriber-level access or higher can exploit this flaw to append additional SQL queries and extract sensitive database information. Attackers can obtain necessary authentication tokens without a WordPress account by subscribing through the public newsletter form and using the management link sent via email. The ownership check only verifies the subscriber_id field and does not confirm that the injected 'id' parameter belongs to the authenticated subscriber.
The Shield Security WordPress plugin up to version 22.3.2 is vulnerable to stored cross-site scripting (XSS) via the 'REQUEST_URI' parameter due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user accesses the affected page. The issue stems from the hidden 'path' column in ForTraffic.php, which is rendered using innerHTML without proper escaping, making it exploitable despite a partial fix applied only to the visible 'page' column in version 18.5.8.
CVE-2026-116964 is a high-severity vulnerability in konflux-ci that allows an attacker with repository write access to execute arbitrary code within the CI/CD workflow environment. The flaw arises from manifest synchronization scripts dynamically evaluating unvalidated script output via injected shell commands. Exploitation can compromise CI/CD pipelines, expose sensitive authentication tokens and deployment credentials, and lead to unauthorized access to production systems. Mitigation currently relies solely on user review of pull requests or merge requests to prevent malicious commits from being approved.
CVE-2026-117681 is a vulnerability in konflux-ci where the user interface proxy disables TLS certificate verification for internal backend service connections in environments without a default service certificate authority. This allows an adjacent network attacker who can intercept traffic to capture a cluster-scoped authentication token with user impersonation rights, potentially leading to full administrative control of the cluster. The issue primarily affects non-OpenShift Kubernetes clusters lacking the platform's automatic service CA. Red Hat classifies this vulnerability as important but notes that standard OpenShift environments are not impacted due to enforced TLS verification.
The User Frontend WordPress plugin up to version 4.3.13 contains a privilege escalation vulnerability via the post_content parameter in the submit_post() function. An attacker with Subscriber-level access can inject a specially crafted shortcode that bypasses shortcode filtering, enabling the creation of an Editor-level account with active session privileges on the frontend. This occurs due to inconsistent sanitization methods and conditional shortcode registration tied to is_admin() checks.
The WP Activity Log plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 5.6.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'Subject' parameter used in mail-sending features. This vulnerability affects all versions up to and including 6.2 and allows unauthenticated attackers to inject malicious scripts that execute when a user views the affected page. The issue arises due to insufficient input sanitization and output escaping, particularly when OAuth authorization is not completed immediately after plugin activation.
The SEOPress AI SEO Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'display_name' parameter affecting all versions up to and including 10.3. Authenticated users with subscriber-level access or higher can inject malicious scripts via their display name, which are then executed when other users view the affected pages. This occurs due to insufficient input sanitization and output escaping in the plugin's handling of the %%archive_title%% token combined with WordPress's storage of display names without HTML filtering.
The Content Pilot plugin for WordPress versions up to and including 2.2.4 is vulnerable to stored cross-site scripting (XSS). The vulnerability arises because the plugin processes HTML meta descriptions from remotely fetched articles without proper sanitization before storing them as post content. This allows unauthenticated attackers who control RSS feed content configured in the plugin to inject malicious scripts that execute when users view the affected pages.
The WP Data Access – App Builder plugin for WordPress has a vulnerability in all versions up to 5.5.88 that allows unauthenticated attackers to extract sensitive information via the 'rel_tab' parameter. This includes database rows such as WordPress user password hashes, email addresses, and password-reset keys. Exploitation requires that an administrator has published at least one app with REST API authorization set to 'anonymous', which is the default for publicly embedded apps.
The Product Filter for WooCommerce by WBW plugin for WordPress up to version 3.4.6 has a missing authorization vulnerability in its 'filtersFrontend' AJAX action. This flaw allows unauthenticated attackers to manipulate query parameters and enumerate non-public WooCommerce products, including drafts and pending items, and to perform unbounded queries that retrieve all products in a single request.
The Redux Framework plugin for WordPress up to version 4.5.15 suffers from an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to view sensitive configuration data, including plaintext passwords, API keys, license keys, and SMTP credentials, exposed in the inline JavaScript on the wp-admin/profile.php page. The vulnerability arises because the plugin does not properly verify user authorization for certain actions. The Users extension, which is automatically loaded for every Redux instance, causes all sites using Redux Framework to be affected regardless of explicit configuration.