The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.
The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.
The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.
The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration.
The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.
The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.
CVE-2025-15705 is a cross-site scripting (XSS) vulnerability in the Contact Form by Supsystic WordPress plugin versions before 1.8.0. The flaw arises because the plugin does not properly sanitize and escape the form name, allowing users with form editor access to inject arbitrary scripts. On multisite WordPress installations, this vulnerability can cross privilege boundaries when administrators lack the unfiltered_html capability. The issue is fixed in version 1.8.0.
The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.
CVE-2026-116044 is a medium severity vulnerability in prasathmani TinyFileManager up to version 2.6. It involves an unrestricted file upload flaw in the Remote URL File Upload Module within tinyfilemanager.php. This vulnerability allows remote attackers to upload files without proper restrictions. The vendor was contacted but did not respond, and public exploit details have been disclosed.
The URL https://pastebin.com/raw/QGrjKCsR was observed in the wild as part of attacker activity on 2026-10-25. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used for tool download, callback, or exploitation purposes. The activity was detected by OffSeq Mirage honeypot sensors and originated from attacker infrastructure in Great Britain. There are no known exploits actively using this URL, and no specific affected software versions have been identified.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (9173b1e0c1d01cafb58dfbcad8b59a50f49700cc911e22df2787f5a92b4c6e43)
The package ships a `beacon.cjs` that collects host identifiers (hostname, install path, current working directory, Node version) and POSTs them in cleartext to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc. This beacon is wired to run automatically in two places: `package.json` declares `scripts.postinstall = "node beacon.cjs"`, so it executes on `npm install`, and `index.js` also invokes the same `fire()` function at module load, so it executes again on `require()`. The remainder of the package is a no-op Proxy shim with no functional code matching the stated `Compatibility shim` description. The scope-and-version shape (`@drone-js-ext/core` at version 99.0.1 against a plausibly internal `@drone-js-ext/*` namespace) matches a dependency-confusion lure designed to be resolved in place of a private internal package. A README self-label of `dependency-confusion test` does not change the behavior: any installer that resolves this package has host-identifying data sent to a non-vendor, non-registry, bare-IP, plaintext-HTTP collector controlled by a third party.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (914f57c3481f23f4682ff7bdd7b9849865531023c6d547ed76d42e9da6bbd8dc)
@drone-js-ext/vip-badge is a functionless stub whose only behavior is a phone-home beacon. The package.json postinstall script runs `node beacon.cjs`, and `index.js` fires the same beacon on `require()` while exporting a Proxy that returns no-ops for every property access. beacon.cjs collects the installer's hostname (`os.hostname()`), install path (`__dirname`), current working directory (`process.cwd()`), Node.js version, and package coordinate, then POSTs them as JSON to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The destination is not the npm registry, not a publisher-owned domain, and is reached automatically at install time and on module load without any caller invocation. The scope name mimics a plausible internal/vendor namespace, and the shipped contents match the dependency-confusion beacon pattern — a stub published to prove install on target networks and disclose host identity to an uncontrolled third party.
CVE-2026-116007 is a medium severity vulnerability in YunaiV's ruoyi-vue-pro version 2026.09. It involves improper restriction of excessive authentication attempts in the SMS code verification function SmsCodeServiceImpl.validateSmsCode0. The flaw allows remote attackers to potentially bypass rate limiting on authentication attempts. Exploitation complexity is high and no privileges or user interaction are required. Public exploit code exists, but no known active exploitation in the wild has been reported. The vendor has not responded to disclosure requests and no patch or mitigation guidance is currently available.
CVE-2026-116006 is an improper authentication vulnerability in the SMS Code Verification function of the AuthController.java file in YunaiV's ruoyi-vue-pro version 2026.09. The flaw allows remote attackers to bypass authentication by manipulating the mobile or code arguments. Public exploit code exists, but no vendor response or patch has been provided.