The Flatsome WordPress theme up to version 3.20.12 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with contributor-level access or higher can inject malicious scripts via certain HTML attributes ('data-text-sec', 'data-title', and 'title') in Custom HTML blocks. The vulnerability arises because the theme does not properly sanitize or escape these attributes, and WordPress's wp_kses_post function permits data-* attributes globally, allowing the malicious payload to persist and execute in users' browsers when they visit affected pages.
The npm package @sfunction/dsh-screenshot version 0.1.1 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, secure machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
A malicious actor sent a job offer containing a ZIP archive with a Git repository specially crafted to execute malicious code automatically. The repository included a .git directory with a custom hooksPath redirecting Git hooks to an obscure location and a Git filter configured to run a script whenever git status or branch switching commands are executed. This script downloads and executes code from a remote server without requiring explicit user action beyond normal Git commands. The attack leverages legitimate Git features (hooks and filters) to trigger code execution stealthily.
The trezortranslate package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
CVE-2026-129181 is a SQL injection vulnerability in projectworlds Visitor Management System version 1.0. The flaw exists in the mysqli_query function within the /img/user page.php file at the Login Endpoint, where manipulation of the Username parameter allows injection. This vulnerability can be exploited remotely and public exploit code is available. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
CVE-2026-129319 is a high-severity vulnerability in the create-ecdh library (versions before 4.0.5) used by browserify. The flaw involves improper input validation of peer public keys in the ECDH key agreement process, allowing attackers to submit crafted keys that can lead to private key recovery or predictable shared secrets. This issue affects the JavaScript implementation used on Node.js versions lacking native crypto.createECDH support. The vulnerability is fixed in version 4.0.5.
The Optimole WordPress plugin up to version 4.2.19 contains a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server due to insufficient file path validation. Exploitation requires the presence of PEAR's Archive_Tar library and an administrator to perform a rename action on an attachment after the attacker stages a malicious payload. This can lead to remote code execution if critical files like wp-config.php are deleted. The vulnerability has a high severity score of 7.1 and requires user interaction by an administrator to be exploited.
The AutomatorWP Pro plugin for WordPress' webhook addon contains an authorization bypass vulnerability in all versions up to and including 1.4.4. This flaw allows unauthenticated attackers to reset the password of any WordPress account, including administrators, leading to full account takeover. Exploitation requires a specific plugin configuration involving a Receive Webhook trigger paired with an Update-User action with certain fields set as described in the advisory.
The Quick Page/Post Redirect Plugin for WordPress versions 5.2.1 through before 5.2.4 contained a hidden update mechanism that fetched updates from a malicious server controlled by the plugin author instead of the official WordPress.org repository. This mechanism was exploited in March 2021 to deliver a backdoored plugin build (version 5.2.3) that injected arbitrary content into pages and delivered arbitrary code, primarily serving SEO spam links to visitors and search engine crawlers. The plugin was fixed in version 5.2.4, which restored the official update channel and removed the backdoor.
A SQL injection vulnerability exists in the WP Ultimate CSV Importer WordPress plugin before version 9.3. This flaw occurs because values from imported files are not properly escaped before being used in SQL queries when importing LifterLMS content. The vulnerability allows high privilege users, such as administrators on single or multisite WordPress installations, to perform SQL injection attacks.
A vulnerability in WP Ultimate CSV Importer WordPress plugin versions before 9.2 and WP Ultimate CSV Importer Pro before 9.0.7 allows unauthenticated attackers to download exported post data. The plugins do not protect files created by their single post export feature, storing them in publicly accessible locations with predictable filenames. This exposure includes content and custom fields of any exported post, including non-public posts.
A stored cross-site scripting (XSS) vulnerability exists in the Lightbox with PhotoSwipe WordPress plugin before version 5.19.0. The plugin fails to properly sanitize link titles and other caption sources before inserting them as HTML into image lightbox captions. This flaw allows unauthenticated users to inject malicious scripts via comments, which are then executed in the context of users viewing the affected captions.
A cross-site scripting (XSS) vulnerability exists in the Checkout Files Upload for WooCommerce WordPress plugin versions 2.4.0 up to but not including 2.4.1. The plugin fails to properly verify uploaded file types at checkout, allowing unauthenticated users to upload HTML files disguised as images. When a shop manager or administrator views the uploaded file from the order screen, the malicious JavaScript executes in their browser. This issue is a regression of a previously fixed vulnerability (CVE-2025-4212) and was reintroduced in version 2.4.0.
SEOJuice WordPress plugin versions before 2.12.0 contain a Cross-Site Request Forgery (CSRF) vulnerability that disables WordPress's REST nonce protection site-wide. This allows unauthenticated attackers to perform any REST API action that requires cookie authentication by tricking a logged-in administrator into visiting a malicious page, including creating new administrator accounts.
The Swipe WordPress plugin versions up to 1.4 contain an authentication bypass vulnerability that allows unauthenticated attackers to obtain WordPress session cookies without proper login verification. This flaw enables attackers to log in as any existing user, including administrators, if that user has an active app session.
The Duplicate Post WordPress plugin versions before 1.5.8 contain a missing authorization vulnerability. This flaw allows users with roles granted access to the plugin, such as Contributors, to publish posts without proper permission checks. As a result, these users can create published posts, including posts attributed to other users, which they normally should not be able to do.
The Duplicate Post WordPress plugin versions before 1.5.8 contain an authorization flaw where users with roles granted access to the plugin, such as Contributor, can duplicate posts without verifying edit permissions. When the slug takeover option is enabled, this allows such users to move any readable post off its original permalink and publish their copy at that address.
The Duplicate Post WordPress plugin versions before 1.5.8 have a missing authorization check when saving global settings. This flaw allows users with any role granted access by an administrator, including low-privilege roles such as Subscriber, to overwrite global settings, including the role-access list itself.
A missing authorization vulnerability in the Flatsome WordPress theme before version 3.20.13 allows users with the Contributor role to publish their own content and change its post type via an AJAX save action without having the necessary permissions.
A vulnerability in the Flatsome WordPress theme before version 3.20.13 allows unauthenticated users to access unpublished post content via an AJAX action that lacks proper capability or nonce checks. This exposure includes draft and pending posts, potentially leaking sensitive information.