Threat Intelligence Database

CVE-2026-89161 is a high-severity vulnerability in PCRE2 versions before 10.48. It involves an incorrect free operation in the pcre2_jit_match function when handling a previously copied subject passed as context, leading to a use-after-free or double-free condition.

CVE-2026-89160 is an out-of-bounds read vulnerability in PCRE2 versions from 10.34 up to but not including 10.48. The flaw occurs during the PCRE2_MATCH_INVALID_UTF matching process when handling an invalid UTF subject. This vulnerability has a low severity rating and does not impact confidentiality or integrity, only availability to a limited extent.

CVE-2026-89158 is an integer overflow vulnerability in PCRE2 versions before 10.48 on 32-bit platforms. The flaw occurs in the pcre2_compile_32 function, leading to an out-of-bounds write. This vulnerability has a medium severity rating and a CVSS score of 6.5.

CVE-2026-89157 is an integer overflow or wraparound vulnerability in PCRE2 versions 10.30 up to but not including 10.48 on 32-bit platforms. It occurs in the pcre2_pattern_convert function when processing a large pattern, leading to an out-of-bounds write. This vulnerability can cause integrity and availability impacts but does not affect confidentiality.

CVE-2026-89156 is an out-of-bounds read vulnerability in PCRE2 versions from 10.34 up to but not including 10.48. It occurs in the pcre2_match function after a JIT fallback when processing invalid UTF data. The vulnerability has a low severity score and does not impact confidentiality or integrity but may affect availability.

The Themify – WooCommerce Product Filter WordPress plugin versions up to and including 1.5.5 contain a reflected cross-site scripting (XSS) vulnerability. This flaw arises from improper input sanitization and output escaping of a query parameter, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires tricking a user into clicking a crafted link, potentially leading to script execution in the victim's browser.

The Bold Timeline Lite WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'supertitle' and 'subtitle' attributes of the 'bold_timeline_item' shortcode. This vulnerability affects all versions up to and including 1.2.8. Authenticated users with Contributor-level access or higher can inject arbitrary scripts that execute when other users view the affected pages.

The UsersWP WordPress plugin up to version 1.2.70 contains a path traversal vulnerability that allows authenticated users with Subscriber-level access or higher to delete arbitrary files on the server. This occurs due to insufficient validation and normalization of file paths in the upload_file_remove() AJAX handler, enabling crafted input to bypass checks and cause deletion of files outside the intended directory.

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in versions up to and including 1.4.3. This vulnerability arises from insufficient input sanitization and output escaping in the wp_load_js() function, which processes filter values from URL path segments and embeds them into inline JavaScript without properly escaping single quotes. An unauthenticated attacker can exploit this by tricking a user into clicking a crafted link, causing arbitrary script execution in the user's browser.

The Relevanssi – A Better Search WordPress plugin is vulnerable to reflected cross-site scripting (XSS) in versions up to and including 4.28.1. The vulnerability arises from insufficient sanitization and escaping of user input in the relevanssi_debug_array() function, which outputs user-controlled data inside a <pre> block without HTML escaping. This debug output can be triggered by setting the relevanssi_debug=on parameter when debugging mode is enabled by an administrator. There is no nonce, capability, or logged-in user check protecting this debug path, allowing unauthenticated attackers to inject malicious scripts that execute if a victim clicks a crafted link.