Threat Intelligence Database

Brave Popup Builder versions through 0.8.5 contain an authorization bypass vulnerability (CWE-639) that allows any logged-in user, including Subscribers or WooCommerce Customers, to access popup content they should not be able to view by manipulating the post ID in the URL. This issue affects access control mechanisms within the plugin.

CVE-2026-77115 is a cross-site scripting (XSS) vulnerability in Brave Popup Builder up to version 0.8.5. It occurs because UTM query parameters are reflected into popup form HTML without proper escaping. This can allow injection of malicious scripts in affected versions.

The Content Mask WordPress plugin before version 1.8.5.5 contains an improper privilege management vulnerability. It fails to verify the required capability to publish certain post types, allowing users with the Contributor role to publish posts and pages without having the publish capability. This could lead to unauthorized content publication on affected sites.

CVE-2026-14853 is a missing authorization vulnerability in the WooCommerce Bookings WordPress plugin before version 3.9.0. The plugin fails to perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token. This allows users with Subscriber-level access and above to create draft bookable products without proper authorization.

CVE-2026-13598 is a vulnerability in the RestrictMate WordPress plugin prior to version 1.3.0. It allows unauthenticated attackers to specify arbitrary user roles during account registration, enabling them to create new administrator accounts. This leads to unauthorized administrator access and potential full site takeover.

CVE-2026-78062 is a medium severity vulnerability in vas3k TaxHacker versions 0.8.0, 0.8.1, and 0.8.2. It involves hard-coded credentials due to manipulation of the BETTER_AUTH_SECRET argument in the envSchema.parse function within the JWT Secret Handler component. The vulnerability can be exploited remotely. The project has been informed but has not yet responded. The product is a cloud service, and a patch is available.

CVE-2026-78063 is a command injection vulnerability in the Tenda CH22 router firmware version 1.0.0.1. The flaw exists in the formeditFileName function of the /goform/editFileName endpoint, where the editNameMit parameter can be manipulated to execute arbitrary commands remotely. The vulnerability has a medium severity rating with a CVSS score of 5.3. Public exploit code is available, but no official patch or remediation guidance has been provided by the vendor as of the publication date.

CVE-2026-78061 is a server-side request forgery (SSRF) vulnerability in vas3k TaxHacker versions 0.8.0, 0.8.1, and 0.8.2. The flaw exists in the buildImapConfig function within the Email Sync component, where manipulation of the host or port arguments can lead to SSRF. This vulnerability can be exploited remotely. A patch has been developed but is pending acceptance. The product is a cloud service, so remediation may be managed by the vendor.

SourceCodester Stock Management System version 1.0 contains a cross-site scripting (XSS) vulnerability in the /php_action/getOrderReport.php file. This vulnerability arises from improper handling of the clientName and clientContact parameters, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

SourceCodester Stock Management System version 1.0 contains a cross-site scripting (XSS) vulnerability in the /php_action/printOrder.php file. The vulnerability arises from improper handling of the clientName and clientContact parameters, allowing remote attackers to inject malicious scripts. This issue has been publicly disclosed and can be exploited remotely. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation guidance is currently available.