CVE-2026-114707 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetElements For Elementor. It affects versions from initial releases up to 2.9.2.5. The flaw involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. A fix is available in version 2.9.2.6.
CVE-2026-115594 is a vulnerability in David Lingren's Media Library Assistant that allows insertion of sensitive information into sent data. This flaw affects versions from initial releases up to 3.42. The vulnerability has a CVSS score of 6.5, indicating a medium severity. It is fixed in version 3.43.
CVE-2026-115608 is a high-severity SQL Injection vulnerability in Crocoblock JetEngine versions prior to 3.9.0.1. It allows improper neutralization of special elements in SQL commands, potentially enabling an attacker with low privileges to execute unauthorized SQL queries. The vulnerability affects all versions from initial release up to 3.9.0 inclusive. A fix is available in version 3.9.0.1.
CVE-2026-115953 is a stored cross-site scripting (XSS) vulnerability in the Geo Mashup plugin developed by Dylan Kuhn. The flaw involves improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts. This vulnerability affects Geo Mashup versions from the initial release up to 1.13.22. A fix is available in version 1.13.23. The CVSS 3.1 base score is 6.5, indicating a medium severity level.
CVE-2026-115954 is a missing authorization vulnerability in Dylan Kuhn's Geo Mashup plugin affecting versions up to 1.13.22. The flaw allows exploitation due to incorrectly configured access control security levels. A fix is available in version 1.13.23. The vulnerability has a medium severity with a CVSS score of 5.4.
CVE-2026-115950 is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin Better Post & Filter Widgets for Elementor by WP Smart Widgets. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. Versions from initial release up to 1.9.1 are affected. The issue is fixed in version 1.9.2.
CVE-2026-115951 is a stored cross-site scripting (XSS) vulnerability in Kevin Weber's Lazy Load for Videos plugin affecting versions before 2.18.12. The flaw involves improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts that can be executed in the context of other users. This vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. The issue is fixed in version 2.18.12.
CVE-2026-111497, dubbed Node2Shell, is a critical out-of-bounds write vulnerability in Google’s Brotli decoder affecting versions 1.0.3 through 1.2.0. It impacts multiple platforms including Node.js, .NET, PowerShell, and Python packages, allowing unauthenticated attackers to cause memory corruption that can lead to process crashes, memory leaks, or arbitrary code execution. The flaw has been patched in Brotli versions 1.0.10, 1.1.1, and 1.2.1, with corresponding updates released by Microsoft, Node.js, and Python package maintainers. No exploitation in the wild has been reported, but proof-of-concept code demonstrates code execution on certain Linux arm64 Node.js builds. The vulnerability arises when attacker-controlled compressed data is processed by the affected Brotli decoder.
CVE-2026-116256 is a server-side request forgery (SSRF) vulnerability in the geesondog RhaPHP project affecting the image function in application/mp/controller/Show.php within the Mp Module Media Proxy component. The vulnerability allows remote attackers to manipulate the 'url' argument to induce SSRF. The product uses a rolling release model, so no specific affected or fixed versions are provided. The vendor did not respond to disclosure attempts. Public exploit code is available. The CVSS 4.0 base score is 6.9, indicating medium severity.
CVE-2026-115948 is a Blind SQL Injection vulnerability in David Lingren's Media Library Assistant affecting versions prior to 3.43. The flaw allows an attacker with low privileges to execute unauthorized SQL commands, potentially leading to high confidentiality impact and limited availability impact. A fix is available in version 3.43.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1.
Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through 2.8.2.
Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
CVE-2026-116255 is a path traversal vulnerability in PGYER codefever affecting the _detail function in application/controllers/doc.php. The flaw allows remote attackers to manipulate the uri_string argument to perform path traversal. The product uses a rolling release model, so specific affected versions are not provided. A patch identified by commit e4433eee96883a222403854e8ac38b3146774a07 is available to fix the issue. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.1.