The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter in all versions up to and including 7.5.55.7212. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and a site administrator to approve a malicious comment containing a crafted shortcode. Once approved, the injected script executes for any visitor interacting with the video player on the affected page.
A SQL injection vulnerability exists in the cak-filemanagement-system affecting the mysqli_query function in admin/save_student.php. The flaw allows remote attackers to manipulate multiple parameters leading to SQL injection. Exploit code has been publicly disclosed, but the project has not issued a response or fix yet. The vulnerability is rated high severity with a CVSS score of 7.3.
The CP Multi View Events Calendar plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'Subject' parameter. This affects all versions up to and including 1.4.43. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. The exploit requires access to a nonce localized to any published page with the calendar shortcode, making the attack feasible for authenticated users.
A vulnerability exists in JetBrains Toolbox App versions before 3.9.1 and 3.8.2, and IntelliJ IDEA versions before 2026.3 and 2026.2.4, where the jetbrainsd daemon improperly trusts compromised intermediate certificates. This flaw can lead to a critical security impact including full confidentiality, integrity, and availability compromise.
A vulnerability identified as CVE-2026-118696 affects multiple JetBrains IDEs including IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip, RustRover, and DataSpell in versions prior to specified 2026.x and 2025.x releases. The issue involves the embedded browser trusting revoked intermediate certificates, which can lead to a high-impact security breach. The vulnerability has a high CVSS score of 8.0, indicating significant confidentiality and integrity impact with no known exploitation in the wild at this time.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a vulnerability allowing unauthenticated attackers to execute arbitrary shortcodes. This affects all versions up to and including 2.8.198. The flaw arises from improper validation before invoking the do_shortcode function, enabling arbitrary shortcode execution.
The Like Button Rating ♥ LikeBtn plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the HTTP_CLIENT_IP header parameter. This affects all versions up to and including 2.6.64. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site administrator to have disabled the default 'Be GDPR compliant' option, which normally hashes IP addresses to prevent payload execution. Additionally, an administrator action is necessary to trigger the vulnerability, as attackers cannot exploit it independently.
The Themify Builder plugin for WordPress versions up to and including 7.8.4 contains a stored cross-site scripting (XSS) vulnerability in the 'variations' repeater field of Custom Font posts. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject arbitrary scripts. These scripts execute when a user views the Custom Fonts admin listing page.
The easy.jobs WordPress plugin up to version 2.8.4 is vulnerable to stored cross-site scripting (XSS) via the 'cover_letter' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the affected candidate's Application tab and clicks a crafted link. The issue arises from insufficient input sanitization and output escaping, enabling exploitation through WHATWG URL parsing to execute JavaScript payloads.
The Avada Website Builder theme for WordPress and WooCommerce is vulnerable to an arbitrary file upload flaw in versions up to and including 7.16.2. The vulnerability arises from insufficient file type validation in the convert_palette_images_to_truecolor() function, allowing unauthenticated attackers to upload potentially executable files. This can lead to remote code execution on affected systems.
The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, contains a privilege escalation vulnerability in all versions up to and including 2.9.8. The flaw arises from missing capability checks in certain AJAX handlers, allowing unauthenticated attackers to update arbitrary WordPress options. This can enable attackers to escalate privileges to administrator by setting user registration to enabled with the default role as administrator.
The Email Templates Customizer and Designer for WordPress and WooCommerce plugin is vulnerable to an authorization bypass in all versions up to and including 1.5.14. This flaw allows unauthenticated attackers to enumerate WooCommerce order IDs and exfiltrate customers' billing information, including names, addresses, phone numbers, and email addresses. The exploit requires two unauthenticated requests involving nonce harvesting and order ID submission to the preview endpoint, enabling full customer PII disclosure without credentials.
The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin WordPress plugin contains an authorization bypass vulnerability in all versions up to and including 1.1.16. This flaw allows authenticated users with subscriber-level access or higher to modify other users' placement rows and read serialized metadata of referenced entities. Exploitation requires the presence of orphaned placements, a state created by the plugin's trash cascade mechanism, and the attacker must enable OpenStation via an AJAX endpoint accessible with minimal privileges.
The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'comment' shortcode attribute 'align' in all versions up to and including 7.5.55.7212. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts into comments. Exploitation requires the plugin's 'Parse Vimeo and YouTube links' setting to be enabled, which causes shortcode attributes in comments to be rendered unescaped, affecting all users who view the injected content.
The Independent Analytics Pro WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw via the 'utm_campaign' parameter in all versions up to and including 2.15.5. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. Exploitation requires the Pro build to be active and involves replaying a server-signed payload with a crafted utm_campaign value against an unauthenticated REST endpoint.
The Advanced Custom Fields: Extended plugin for WordPress versions up to and including 0.9.2.7 contains a vulnerability that allows unauthenticated attackers to expose sensitive information. By injecting a {get_user} template tag into a publicly accessible form configured with specific shortcode and field mappings, attackers can retrieve sensitive data such as WordPress password hashes. This requires that an administrator has set up a public [acfe_form] shortcode page with a Term action using a save.name field mapping, which is a supported configuration.
The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 7.5.55.7212. This flaw arises from insufficient input sanitization and output escaping of the 'fv_player_videos[_fv_player_user_video][]' parameter. Authenticated users with subscriber-level access or higher can exploit this vulnerability to inject arbitrary scripts into pages, which execute when accessed by other users. Exploitation requires that an administrator has enabled the 'Allow visitors to upload videos to their profile' setting.
The JS Help Desk plugin for WordPress up to version 5.0.1 contains a vulnerability that allows authenticated administrators to delete arbitrary files on the server due to insufficient validation of file paths in the setSupportCustomImage function. Exploitation involves a two-step process where an attacker first sets a crafted path in a configuration field and then triggers deletion by uploading a new image. This can lead to remote code execution if critical files like wp-config.php are deleted.
The Redux Framework plugin for WordPress versions up to and including 4.5.15 contains a stored cross-site scripting (XSS) vulnerability via the multi_media field. This occurs because the field's renderer outputs stored values into multiple HTML contexts without proper escaping. Additionally, a flaw in permission checking allows authenticated users with Subscriber-level access to inject scripts into their own profile, which execute when an administrator views that profile. Exploitation requires a theme or plugin that registers a multi_media field through the Redux Users API.
Blender versions before 4.5.15 and 5.x before 5.2.3 contain an out-of-bounds read vulnerability in the blo_bhead_id_* accessors within readfile.cc. This flaw allows crafted .blend files with short ID blocks to cause heap over-reads, potentially leading to application crashes or disclosure of heap memory.