The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display WordPress plugin is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the 'atkp_product_producturl' parameter in versions up to and including 3.9.2. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires the plugin's AJAX loading or AJAX handler option to be enabled, or contributor-level access if these are not enabled by default.
The AMP for WP – Accelerated Mobile Pages WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'headline-*' shortcode attribute in all versions up to 1.1.17. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The issue is exacerbated by WordPress core's filtering which does not remove shortcode syntax from subscriber biographical info fields, and the AMP content sanitizers running before shortcode processing, leaving the injected markup unsanitized.
The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires only that the chatbot module is active with at least one configured bot; the attacker stores the payload via three unauthenticated REST calls, and the JavaScript widget auto-poll then delivers it to any administrator who opens wp-admin/index.php.
The All-in-One Video Gallery plugin for WordPress versions up to 4.9.7 contains a stored cross-site scripting (XSS) vulnerability via the 'more_link' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
Pie Register Premium WordPress plugin versions up to 3.8.4.0 suffer from an unrestricted file upload vulnerability. The plugin fails to properly verify file type validation results before saving uploaded files, and lacks nonce or capability checks on the AJAX upload handler. This allows unauthenticated attackers to upload dangerous file types such as executable PHP scripts, enabling potential remote code execution. The server response reveals the uploaded file's path, facilitating exploitation.
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a visitor to click the attacker's Website URL link on their public Ultimate Member profile, a condition that is trivially met since the redirect-confirmation onclick handler is enabled by default on all new installations.
GROWI versions 7.0.0 through 8.0.6 have a missing authorization check vulnerability in the collaborative editing feature. This flaw allows users with read-only permissions, including guest users or users with pending, suspended, or invited status, to modify page drafts. The vulnerability has a medium severity rating with a CVSS score of 5.3.
GROWI contains an authorization bypass vulnerability in its tag update and page update APIs. This flaw arises from improper use of a user-controlled key, allowing authenticated attackers to access page contents without having the required read permissions and save them to pages they can edit. The vulnerability affects versions from 4.5.5 through 8.0.6. The CVSS score is 4.2, indicating medium severity.
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality. This flaw arises from improper use of a user-controlled key, allowing an authenticated attacker to access page contents and comments without having the necessary read permissions. The vulnerability affects versions from 3.2.10 through 8.0.6. The CVSS score is 4.2, indicating a medium severity level.
The glyphmatrix-fixture npm package versions 1.0.0 and 1.0.1 contain malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removal of the package alone may not eliminate the malicious software, as the attacker may have gained full control of the system.
Tabularis versions before 0.28.0 have an SQL injection vulnerability in the SQLite driver. This flaw allows malicious clients to execute multiple SQL statements by manipulating the table_name parameter in the describe_table tool. Exploitation can bypass read-only restrictions and write approvals, enabling unauthorized reading, modification, or deletion of SQLite data. The vulnerability is fixed in version 0.28.0.
mews/pos versions up to 2.0.0 have a vulnerability where unauthenticated attackers can forge payment results by submitting unverified callbacks. Specific payment handlers skip critical verification checks, allowing attackers to manipulate order completion without actual payment.
WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.
An out-of-bounds write vulnerability exists in llama.cpp versions before b11865 in the ggml-rpc RDMA transport's rdma_recv() function. This flaw allows unauthenticated peers advertising RDMA capabilities to overflow a 1-byte stack variable by sending up to 256 KiB of data, potentially crashing the server or enabling code execution.
LibreSSL versions up to 4.4.0 contain a memory exhaustion vulnerability in the ocspcheck component. This flaw allows malicious OCSP responders to send unbounded HTTP responses, causing the client to consume excessive memory. Attackers who control the OCSP responder or can intercept unencrypted HTTP AIA OCSP traffic can exploit this by streaming endless headers or body data, resulting in denial of certificate status checks.
CVE-2026-118373 is a vulnerability in LibreSSL's ocspcheck component up to version 4.4.0 that causes cleartext transmission of sensitive OCSP request data. The issue arises because the function url2host() removes the OCSP URL scheme, and http_alloc() only uses TLS for port 443. As a result, OCSP requests sent to HTTPS responder URLs on non-443 ports are transmitted without encryption, exposing certificate serial numbers, issuer hashes, and nonces to on-path attackers.
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
LibreSSL versions up to 4.4.0 have a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions. This flaw allows attackers to inject carriage return and line feed characters into the OCSP request line by embedding them in a certificate's Authority Information Access OCSP URI. This can lead to HTTP header injection or request splitting when communicating with OCSP responders or proxies.
CVE-2026-118370 is a high-severity vulnerability in libexpat up to version 2.9.0 involving a signed integer overflow in the storeAtts() function. This flaw allows attackers to cause out-of-bounds writes by supplying a document with an extremely large number of attributes, potentially crashing applications or corrupting heap memory.
CVE-2026-117610 is a high-severity vulnerability in libexpat up to version 2.9.0 involving a NULL pointer dereference in the externalEntityInitProcessor2() function. This flaw occurs when the function mishandles the XML_TOK_NONE token from empty input, allowing attackers who control stream chunking to cause a crash by forcing an empty non-final first parse on an external entity subparser.