CVE-2026-125766 is a vulnerability in WPZOOM Social Feed Widget & Block (instagram-widget-by-wpzoom) that allows insertion of sensitive information into sent data. This flaw affects versions from initial releases up to 2.4.1. The vulnerability enables retrieval of embedded sensitive data, potentially exposing confidential information. It has a CVSS score of 5.3, indicating a medium severity level. A fix is available in version 2.4.2.
Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.
CVE-2026-123480 is a stored cross-site scripting (XSS) vulnerability in the Fullworks Plugins Display Eventbrite Events widget-for-eventbrite-api. It affects versions from initial release up to 6.9.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. A fix is available in version 6.9.2.
Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry.
Users are recommended to upgrade to Apache Roller 6.1.7 or later.
CVE-2026-125448 is a missing authorization vulnerability in Kali Forms (Kaliforms) affecting versions from initial up to 2.4.31. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The issue is fixed in version 2.4.32.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was not closed, and the main menu printed the weblog description without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme printed them without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which accepts only web links on import and escapes them on output.
CVE-2026-123481 is a missing authorization vulnerability in The Ultimate WordPress Toolkit – WP Extended plugin versions before 3.4.3. This flaw allows attackers with limited privileges to exploit improperly configured access control, potentially gaining unauthorized access to certain functions. The vulnerability has a medium severity rating with a CVSS score of 4.3. A fix is available in version 3.4.3.
Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID authentication mode are affected; later major versions do not include OpenID 2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
CVE-2026-125763 is a missing authorization vulnerability in Brainstorm Force SureForms versions prior to 2.13.1. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The issue is fixed in version 2.13.1.
Apache Roller versions 5.0.1 through 6.1.6 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw that allows an unauthenticated attacker to create an administrator account if a logged-in administrator visits a malicious link. The vulnerability arises because the request-token check was only applied to POST requests, while administrative actions also accepted GET requests. This issue is fixed in Apache Roller 6.1.7 and later, which require POST requests with a valid token for data-changing actions.
CVE-2026-125743 is a stored cross-site scripting (XSS) vulnerability in the WPVibes Elementor Addon Elements plugin for WordPress. It affects versions from initial releases up to, but not including, version 1.5.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of other users. A fix is available in version 1.5.1.
Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content. AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which shows only published entries in search results.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover the email addresses of people who left approved comments. The search index stored commenter email addresses, and the public weblog search accepted queries on that field, including wildcard queries that confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later and rebuild the search index.
CVE-2026-125436 is a missing authorization vulnerability in Mamunur Rashid's The Post Grid plugin, affecting versions prior to 7.9.10. This flaw allows exploitation due to incorrectly configured access control security levels. The issue has a medium severity with a CVSS score of 4.3 and impacts confidentiality but not integrity or availability. A fix is available in version 7.9.10.
Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an authenticated user with the Author role on a weblog that uses a custom theme to store script that runs in the browser of anyone who opens the file's resource URL. The fix for CVE-2026-82387 serves uploaded media as a download unless it is an image, audio, video, PDF or plain text, but media files found through a custom theme were served with the type their path implies, and the upload form let the uploader choose that path. Media uploads are disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which serves these files under the same rules as other media and no longer accepts the path from the upload form.
CVE-2026-125433 is a stored cross-site scripting (XSS) vulnerability in the Futurio Extra plugin by FuturioWP. It affects versions from initial release up to 2.0.25. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts that execute in the context of other users. A fix is available in version 2.0.26.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier.
CVE-2026-105154 is a Cross-Site Request Forgery (CSRF) vulnerability in Apache Roller versions 4.0 through 6.1.6 affecting the Planet feed aggregator administration. An unauthenticated attacker can induce a logged-in global administrator to trigger the addition of a Planet subscription by visiting a crafted web page. This allows the attacker to make the server fetch arbitrary URLs, including internal addresses, and publish fetched feed content without authentication. The vulnerability arises because recent versions accept GET requests for this action, which are not protected by CSRF tokens. Apache Roller 6.1.7 and later address this issue by requiring POST requests with valid CSRF tokens and disabling the Planet aggregator by default.