Threats affecting pkg:generic/mosquitto

The Countdown, Coming Soon, Maintenance WordPress plugin versions through 3.0.8 have an authorization bypass vulnerability in one of its AJAX actions. This flaw allows any authenticated user, including low-privileged roles like subscribers, to retrieve the titles of published posts of any post type, even those normally hidden from them. However, draft, private, and pending posts are not disclosed.

The Countdown, Coming Soon, Maintenance WordPress plugin versions up to 3.0.8 lack authorization and nonce checks when saving countdown data. This flaw allows users with Author-level access or higher to inject arbitrary web scripts due to insufficient output sanitization that permits script tags. These scripts execute when the affected content is viewed on the front end or by administrators.

The Email Marketing 4Dem WordPress plugin versions up to 2.0.5 lack authorization and capability checks on multiple AJAX actions. This flaw allows unauthenticated users to delete stored configurations and records within the plugin.

The Email Marketing 4Dem WordPress plugin versions up to 2.0.5 lack authorization and capability checks on multiple AJAX actions and REST routes. This flaw allows unauthenticated users to access and disclose stored plugin configuration and data, as well as modify the plugin's stored settings.

A nationwide FAA ground stop occurred due to a communications problem at air route traffic control centers, likely caused by a software update overwhelming legacy equipment. Officials, including Homeland Security and the FBI, found no evidence of a cyberattack. The outage lasted over four hours and disrupted thousands of flights, with delays expected to continue. The FAA was applying patches and installing new technology, which may have triggered the failure. No official root cause has been announced, and investigations continue.

The Flatsome WordPress theme up to version 3.20.12 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with contributor-level access or higher can inject malicious scripts via certain HTML attributes ('data-text-sec', 'data-title', and 'title') in Custom HTML blocks. The vulnerability arises because the theme does not properly sanitize or escape these attributes, and WordPress's wp_kses_post function permits data-* attributes globally, allowing the malicious payload to persist and execute in users' browsers when they visit affected pages.

The npm package @sfunction/dsh-screenshot version 0.1.1 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, secure machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.

A malicious actor sent a job offer containing a ZIP archive with a Git repository specially crafted to execute malicious code automatically. The repository included a .git directory with a custom hooksPath redirecting Git hooks to an obscure location and a Git filter configured to run a script whenever git status or branch switching commands are executed. This script downloads and executes code from a remote server without requiring explicit user action beyond normal Git commands. The attack leverages legitimate Git features (hooks and filters) to trigger code execution stealthily.

The trezortranslate package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.

CVE-2026-129181 is a SQL injection vulnerability in projectworlds Visitor Management System version 1.0. The flaw exists in the mysqli_query function within the /img/user page.php file at the Login Endpoint, where manipulation of the Username parameter allows injection. This vulnerability can be exploited remotely and public exploit code is available. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-129319 is a high-severity vulnerability in the create-ecdh library (versions before 4.0.5) used by browserify. The flaw involves improper input validation of peer public keys in the ECDH key agreement process, allowing attackers to submit crafted keys that can lead to private key recovery or predictable shared secrets. This issue affects the JavaScript implementation used on Node.js versions lacking native crypto.createECDH support. The vulnerability is fixed in version 4.0.5.

The Optimole WordPress plugin up to version 4.2.19 contains a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server due to insufficient file path validation. Exploitation requires the presence of PEAR's Archive_Tar library and an administrator to perform a rename action on an attachment after the attacker stages a malicious payload. This can lead to remote code execution if critical files like wp-config.php are deleted. The vulnerability has a high severity score of 7.1 and requires user interaction by an administrator to be exploited.

The AutomatorWP Pro plugin for WordPress' webhook addon contains an authorization bypass vulnerability in all versions up to and including 1.4.4. This flaw allows unauthenticated attackers to reset the password of any WordPress account, including administrators, leading to full account takeover. Exploitation requires a specific plugin configuration involving a Receive Webhook trigger paired with an Update-User action with certain fields set as described in the advisory.

The Quick Page/Post Redirect Plugin for WordPress versions 5.2.1 through before 5.2.4 contained a hidden update mechanism that fetched updates from a malicious server controlled by the plugin author instead of the official WordPress.org repository. This mechanism was exploited in March 2021 to deliver a backdoored plugin build (version 5.2.3) that injected arbitrary content into pages and delivered arbitrary code, primarily serving SEO spam links to visitors and search engine crawlers. The plugin was fixed in version 5.2.4, which restored the official update channel and removed the backdoor.

A SQL injection vulnerability exists in the WP Ultimate CSV Importer WordPress plugin before version 9.3. This flaw occurs because values from imported files are not properly escaped before being used in SQL queries when importing LifterLMS content. The vulnerability allows high privilege users, such as administrators on single or multisite WordPress installations, to perform SQL injection attacks.

A vulnerability in WP Ultimate CSV Importer WordPress plugin versions before 9.2 and WP Ultimate CSV Importer Pro before 9.0.7 allows unauthenticated attackers to download exported post data. The plugins do not protect files created by their single post export feature, storing them in publicly accessible locations with predictable filenames. This exposure includes content and custom fields of any exported post, including non-public posts.

A stored cross-site scripting (XSS) vulnerability exists in the Lightbox with PhotoSwipe WordPress plugin before version 5.19.0. The plugin fails to properly sanitize link titles and other caption sources before inserting them as HTML into image lightbox captions. This flaw allows unauthenticated users to inject malicious scripts via comments, which are then executed in the context of users viewing the affected captions.

A cross-site scripting (XSS) vulnerability exists in the Checkout Files Upload for WooCommerce WordPress plugin versions 2.4.0 up to but not including 2.4.1. The plugin fails to properly verify uploaded file types at checkout, allowing unauthenticated users to upload HTML files disguised as images. When a shop manager or administrator views the uploaded file from the order screen, the malicious JavaScript executes in their browser. This issue is a regression of a previously fixed vulnerability (CVE-2025-4212) and was reintroduced in version 2.4.0.

SEOJuice WordPress plugin versions before 2.12.0 contain a Cross-Site Request Forgery (CSRF) vulnerability that disables WordPress's REST nonce protection site-wide. This allows unauthenticated attackers to perform any REST API action that requires cookie authentication by tricking a logged-in administrator into visiting a malicious page, including creating new administrator accounts.

The Swipe WordPress plugin versions up to 1.4 contain an authentication bypass vulnerability that allows unauthenticated attackers to obtain WordPress session cookies without proper login verification. This flaw enables attackers to log in as any existing user, including administrators, if that user has an active app session.