The Everest Forms plugin for WordPress versions up to and including 3.6.2 suffers from a sensitive information exposure vulnerability. Unauthenticated attackers can exploit this flaw to extract arbitrary WordPress post meta values, such as license keys, API tokens, SMTP credentials, and secrets related to Stripe or AWS. This is possible because the submission nonce is publicly available in every embedded form and can also be generated anonymously via a specific action, requiring no authentication.
The LiteSpeed Cache plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter affecting all versions up to and including 7.9.1. This flaw arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires the HTML Minify option to be enabled and a companion plugin that renders stored comment content in a raw-text context such as a JSON-LD script block on the same page.
The HT Mega Addons for Elementor WordPress plugin (up to version 3.2.7) contains a stored DOM-based cross-site scripting (XSS) vulnerability via the href attribute of anchor tags inside the .htmega-tab-nav parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a co-installed plugin like wpDiscuz with its rich editor enabled, an HT Mega Tabs widget on the same page, and a victim clicking the injected link.
The Greenshift WordPress plugin (animation and page builder blocks) is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'comment' parameter in all versions up to and including 13.2.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. Exploitation requires specific conditions involving administrator-published pages with certain block configurations that trigger the vulnerable script processing comment excerpts.
The Greenshift WordPress plugin, used for animation and page builder blocks, suffers from a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability via the 'comment' parameter in all versions up to and including 13.2.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view affected pages. Exploitation requires a specific page configuration involving an Advanced HTML Element block with Split Text animation wrapping a Latest Comments block displaying comment excerpts.
Checkmk versions prior to 2.5.0p18, 2.4.0p39, 2.3.0p52, and version 2.2.0 (EOL) have improper certificate validation due to inclusion of a root CA that trusts eMudhra (emSign) intermediate certificates with publicly known private keys. This flaw arises from the bundled Certificate Authority stores using "certifi" and "webpki-roots". The vulnerability could allow attackers to exploit the trust in these compromised intermediate certificates.
A broken access control vulnerability in Foxit's official website HTML-to-PDF conversion service allows unauthorized users to access documents submitted by others due to a shared token mechanism.
CVE-2026-111418 is a server-side request forgery (SSRF) vulnerability in Foxit's official website HTML-to-PDF conversion service. The vulnerability arises because the service supports ZIP-formatted input, which can bypass restrictions on requests to internal IP addresses. This may allow an attacker to discover internal network resources. The vulnerability has a CVSS 3.1 score of 7.5, indicating high severity. No known exploits or patches are currently documented.
The Sequential Order Numbers for WooCommerce plugin for WordPress versions up to and including 3.6.5 is vulnerable to stored cross-site scripting (XSS) via 'condition' post meta array keys. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.
A medium-severity vulnerability (CVE-2026-88941) was identified and fixed in the Network Agent for Windows module of Kaspersky Security Center. The flaw could cause the Network Agent module to malfunction but has no confirmed exploitation in the wild. The vulnerability involves limited privileges and requires local access, with no impact on confidentiality but potential integrity and availability issues.
The RSS Aggregator by Feedzy WordPress plugin (up to version 5.2.12) is vulnerable to stored cross-site scripting (XSS) via the media:group/media:description XML element in imported feeds. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user views the affected page. Exploitation requires an administrator to configure a feed import pointing to a malicious feed URL and trigger the import through the plugin's standard workflow.
The Everest Forms WordPress plugin up to version 3.6.2 contains a reflected cross-site scripting (XSS) vulnerability via the 'evf_toast_type' parameter. This flaw allows unauthenticated attackers to inject arbitrary scripts that execute in a user's browser if the user is tricked into clicking a crafted link. Exploitation depends on the 'evf_toast' parameter decoding successfully via atob(), which is attacker-controlled.
The Extensions for Leaflet Map plugin for WordPress contains a stored DOM-based cross-site scripting (XSS) vulnerability in all versions up to and including 5.4. This vulnerability arises from insufficient input sanitization and output escaping of the 'feature.properties[<template-token>]' parameter. An unauthenticated attacker can inject malicious scripts that execute when users access affected pages. Exploitation requires prior configuration of a public map using specific shortcode combinations pointing to a GeoJSON source controlled by the attacker, which can be achieved through external data host compromise, subdomain takeover, or intentional pointing to attacker-hosted feeds.
The JoomSport plugin for WordPress versions up to and including 5.7.11 contains a SQL Injection vulnerability via the 'team_id' parameter. This flaw allows authenticated users with contributor-level access or higher to inject additional SQL queries due to insufficient input escaping and query preparation. The vulnerability is triggered when a season lacks an associated joomsport_tournament term, which is the default for new seasons.
A sensitive information exposure vulnerability exists on the Foxit official website due to JavaScript code containing third-party authorization information. This exposure could allow unauthorized parties to obtain or misuse these credentials, potentially leading to significant confidentiality breaches. The vulnerability has a high severity rating with a CVSS score of 8.6.
The Media Library Assistant plugin for WordPress versions up to and including 3.42 is vulnerable to reflected cross-site scripting (XSS) via the 'search-string' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires a publicly accessible page with an [mla_gallery] shortcode configured with pagination output mode and an mla_link_href template reflecting a {+request:...+} token, plus enough attachments to trigger pagination. The CVSS score is 4.7, indicating medium severity.
The Mapster WP Maps plugin for WordPress versions up to and including 2.0.5 is vulnerable to stored cross-site scripting (XSS). The vulnerability arises because the REST route /wp-json/mapster-wp-maps/save-mapmaker lacks proper permission checks, allowing unauthenticated attackers to inject scripts. The plugin's sanitization only removes HTML tags but leaves quote characters intact, and the injected value is concatenated into an inline style attribute without proper escaping. This enables execution of arbitrary scripts when a user views an affected page.
The LiteSpeed Cache plugin for WordPress versions up to and including 7.9.1 contains a stored cross-site scripting (XSS) vulnerability via the 'bbp_reply_content' parameter. This flaw arises from insufficient input sanitization and output escaping, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that attackers can embed in user-generated content such as bbPress topics. The vulnerability has a CVSS score of 6.4, indicating a medium severity level.
A vulnerability in Python's tarfile module allows crafted tar archives with specially crafted symlink entries to bypass the tar_filter mechanism. This can cause tarfile.extractall() with filter="tar" to write files outside the intended extraction directory, potentially overwriting or creating files elsewhere on the filesystem, depending on the extracting process's permissions. This issue affects multiple Python versions prior to fixed releases and is related to a similar flaw in tarfile.data_filter (CVE-2026-7774).
MLflow versions from 3.12.0 up to but not including 3.17.0 contain a server-side request forgery (SSRF) vulnerability in the scorer invoke, register, and GenAI evaluate endpoints. This vulnerability allows unauthenticated attackers to send crafted requests that cause the server to make outbound HTTP requests to attacker-controlled or internal hosts. The issue arises from insecure deserialization of third-party scorer data that is resolved using a module-path allowlist but does not restrict constructor arguments. The vulnerability is fixed in version 3.17.0.