Samedi 10 octobre 2026

Keen IT Solutions Educavo

Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.

designthemes LMS

Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.

Chimpstudio FoodBakery

Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.

Elated-Themes Ambient

Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

WPMU DEV Forminator

Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

Amir Helzer WooCommerce Multilingual & Multicurrency

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

Dmitry V. Barcode Scanner with Inventory & Order Manager

Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

Dmitry V. Barcode Scanner with Inventory & Order Manager

Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

Dmitry V. Barcode Scanner with Inventory & Order Manager

Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

kutethemes KuteShop

Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.

kutethemes KuteShop

Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.

kutethemes Boutique

Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.

kutethemes Biolife

Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.

kutethemes Biolife

Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.

kutethemes TechOne

Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.

kutethemes TechOne

Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.

kutethemes Armania

Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.

kutethemes Armania

Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.

An-Themes Pin WP

Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.

Mymoun Backhoe

Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.

ThemeREX Ozeum

Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

CKThemes Flipmart

Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.

CocoBasic Fabius

Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.

CocoBasic Teoro

Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.

CocoBasic Kaven

Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.

CocoBasic Volos

Unauthenticated Local File Inclusion in Volos <= 1.2 versions.

CocoBasic Cardea

Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.

Bracketweb Ambed

Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.

sevenspark Contact Form 7 – Dynamic Text Extension

Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.

DigitalME eRoom

Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

bPlugins Document Embedder

Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

bPlugins Before After Image Comparison – Image comparison for WP

Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

Stylemix uListing

Subscriber Settings Change in uListing <= 2.2.0 versions.

bPlugins StreamCast

Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

bPlugins Team Section Block

Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

rascals Angio

Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

Mikado-Themes TouchUp

Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

ThemeREX Group Kids Planet

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.

kutethemes DukaMarket

Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.

kutethemes Uminex

Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

Smackcoders Inc. WP Ultimate CSV Importer

Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.

Edge-Themes Aalto

Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

AncoraThemes CleanSkin

Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.

Shabti Kaplan Frontend Admin by DynamiApps

Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

VaultDweller Leyka

Administrator SQL Injection in Leyka <= 3.32.3 versions.

10Web Photo Gallery by 10Web

Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

Qode Tours

Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

10Web Slider by 10Web

Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

RadiusTheme Food Menu – Restaurant Menu & Online Ordering for WooCommerce

Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

ThemeGoods DK

Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

ThemeGoods Grand News

Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

axiomthemes Kids Care

Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

Themeum Tutor LMS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

FolioVision FV Player 8

Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

Inisev Social Share Icons & Social Share Buttons

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5.

TieLabs Jannah

Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.

Marcus Events Manager

Subscriber SQL Injection in Events Manager <= 7.4.6 versions.

Qode Real Estate

Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

Qode Music

Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

Web Plura Backup &amp; Restore Manager

Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions.

PeepSo

Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.

Jotform &#8211; AI Chatbot

Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.

Pubjet | پاب‌جت

Subscriber Settings Change in Pubjet | پاب‌جت <= 5.4.8 versions.

Wordable

Subscriber Broken Access Control in Wordable <= 8.2.10 versions.

Rashid WPSection

Subscriber Broken Access Control in WPSection <= 1.5.1 versions.

everestthemes Everest Backup

Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.

Anton Bond Additional Order Filters for WooCommerce

Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.

Joomunited WP File Download

Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

Builderius.io Builderius

Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.

WPMU DEV Forminator

Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

drfuri Martfury - WooCommerce Marketplace WordPress Theme

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9.

ThemeStek Extras for LabtechCO Theme

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4.

bPlugins Super Video Player

Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.

Web Impian Bayarcash WooCommerce

Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.

Automattic WooCommerce

Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.

VillaTheme Thank You Page Customizer for WooCommerce

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.

OpenRefine

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

iflytek skillhub

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.

chenhg5 cc-connect

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.

iflytek astron-rpa

AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.

spotweb

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.

Greg Winiarski WPAdverts

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issue affects WPAdverts: from n/a through 2.3.4.

Greg Winiarski WPAdverts

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through 2.3.4.

Tainacan Community Tainacan

Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.

fusionpbx

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.

10Web Slider by 10Web

Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.

WPMU DEV Forminator

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion. Note that a similar issue was fixed in ExtUtils::Typemaps::STL::Vector version 1.05.

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion.

Apache Software Foundation Apache DataSketches

Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes past the end of the input. For such inputs, the size remaining for the embedded sketch was also computed by an unsigned subtraction that could wrap around, so the embedded sketch's own size checks no longer limited reads to the input. The bytes read can become part of the deserialized union's state. This can cause a crash (denial of service) and could expose adjacent memory contents. This issue affects Apache DataSketches C++: from 2.0.0-incubating before 5.3.0. Only applications that deserialize VarOpt unions from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.

Divi Essential Divi Plus

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs — before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON 'html' field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server which may make remote code execution possible.

HivePress – Business Directory, Listings & Classified Ads Plugin

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern &lt;a href="%value%"&gt;Custom link&lt;/a&gt;), and for front-end user profiles to be enabled — both of which reflect the plugin's standard, documented configuration.

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored in the wpo365_errors transient for up to three days by submitting a crafted unauthenticated request with a forged id_token whose base64url-decoded unique_name or iss claim contains malicious HTML, requiring no prior authentication or user interaction beyond an administrator later visiting the WPO365 wizard page.

latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

opajaap WP Photo Album Plus

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass works because esc_url_raw() strips literal angle brackets but retains HTML entities, which wppaEntityDecode() silently converts back to live HTML tags before jQuery('#wppa-modal-container').html() renders them.

Bracketweb Zeinet

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zeinet: from n/a through 1.0.0.

StylemixThemes Motors

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.

Omegathemes Grocery Shopping Store

Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from n/a through 1.3.3.