CVE-2026-107659 - Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT
CVE ID :CVE-2026-107659
Published : Oct. 16, 2026, 4:27 a.m. | 25 minutes ago
Description :The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-107659
Published : Oct. 16, 2026, 4:27 a.m. | 25 minutes ago
Description :The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-109221 - Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping
CVE ID :CVE-2026-109221
Published : Oct. 16, 2026, 4:27 a.m. | 25 minutes ago
Description :The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-109221
Published : Oct. 16, 2026, 4:27 a.m. | 25 minutes ago
Description :The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-94388 - WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability
CVE ID :CVE-2026-94388
Published : Oct. 16, 2026, 7:17 a.m. | 1 hour, 36 minutes ago
Description :Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-94388
Published : Oct. 16, 2026, 7:17 a.m. | 1 hour, 36 minutes ago
Description :Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-96339 - WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-96339
Published : Oct. 16, 2026, 7:17 a.m. | 1 hour, 36 minutes ago
Description :Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-96339
Published : Oct. 16, 2026, 7:17 a.m. | 1 hour, 36 minutes ago
Description :Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-97296 - WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability
CVE ID :CVE-2026-97296
Published : Oct. 16, 2026, 7:17 a.m. | 1 hour, 36 minutes ago
Description :Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-97296
Published : Oct. 16, 2026, 7:17 a.m. | 1 hour, 36 minutes ago
Description :Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-97640 - WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)
CVE ID :CVE-2026-97640
Published : Oct. 16, 2026, 7:17 a.m. | 1 hour, 36 minutes ago
Description :The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Script Blocking feature to be enabled, and the exploit chain depends on an attacker submitting two coordinated comments — one embedding event-handler syntax inside an allowed <code> element and one placing the deterministic ___noise___ restoration key inside an allowed <abbr title=""> attribute — with the key offset confirmable via an unauthenticated wpconsent_debug=1 request.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-97640
Published : Oct. 16, 2026, 7:17 a.m. | 1 hour, 36 minutes ago
Description :The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Script Blocking feature to be enabled, and the exploit chain depends on an attacker submitting two coordinated comments — one embedding event-handler syntax inside an allowed <code> element and one placing the deterministic ___noise___ restoration key inside an allowed <abbr title=""> attribute — with the key offset confirmable via an unauthenticated wpconsent_debug=1 request.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-14177 - User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure
CVE ID :CVE-2026-14177
Published : Oct. 16, 2026, 8:13 a.m. | 39 minutes ago
Description :Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-14177
Published : Oct. 16, 2026, 8:13 a.m. | 39 minutes ago
Description :Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-100106 - FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter
CVE ID :CVE-2026-100106
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site owner has previously completed the standard Freemius opt-in flow; once that condition is met, any Subscriber can reach the vulnerable handler simply by loading /wp-admin/profile.php with the requisite query parameters.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-100106
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site owner has previously completed the standard Freemius opt-in flow; once that condition is met, any Subscriber can reach the vulnerable handler simply by loading /wp-admin/profile.php with the requisite query parameters.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-100108 - Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting
CVE ID :CVE-2026-100108
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 7-day review-nag timer has elapsed since the attacker's first wp-admin visit, as the nonce needed to reach the save-network handler is only rendered in the DOM once that timer has passed.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-100108
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 7-day review-nag timer has elapsed since the attacker's first wp-admin visit, as the nonce needed to reach the save-network handler is only rendered in the DOM once that timer has passed.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-16251 - Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering
CVE ID :CVE-2026-16251
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized image response.. Mattermost Advisory ID: MMSA-2026-00726
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-16251
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized image response.. Mattermost Advisory ID: MMSA-2026-00726
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-16453 - Mattermost SAML RelayState forgery allows unauthorized team membership
CVE ID :CVE-2026-16453
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-16453
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-18223 - Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access
CVE ID :CVE-2026-18223
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, which allows an authenticated attacker to join a team or gain unauthorized access to private channels via a forwarded or leaked invitation link.. Mattermost Advisory ID: MMSA-2026-00747
Severity: 5.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-18223
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, which allows an authenticated attacker to join a team or gain unauthorized access to private channels via a forwarded or leaked invitation link.. Mattermost Advisory ID: MMSA-2026-00747
Severity: 5.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-18256 - Private team metadata disclosure via the team search API
CVE ID :CVE-2026-18256
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-18256
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-18560 - Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status
CVE ID :CVE-2026-18560
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-18560
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-18799 - Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users
CVE ID :CVE-2026-18799
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to force-add existing Mattermost users to their team and forge posts attributed to those users' identities via a crafted Slack export containing target users' email addresses.. Mattermost Advisory ID: MMSA-2026-00757
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-18799
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to force-add existing Mattermost users to their team and forge posts attributed to those users' identities via a crafted Slack export containing target users' email addresses.. Mattermost Advisory ID: MMSA-2026-00757
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-19076 - Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token
CVE ID :CVE-2026-19076
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a target user to permanently take over that user's SSO-backed account by setting an attacker-controlled password and detaching the account from its identity provider via a crafted request to POST /api/v4/users/login/switch.. Mattermost Advisory ID: MMSA-2026-00758
Severity: 4.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-19076
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a target user to permanently take over that user's SSO-backed account by setting an attacker-controlled password and detaching the account from its identity provider via a crafted request to POST /api/v4/users/login/switch.. Mattermost Advisory ID: MMSA-2026-00758
Severity: 4.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-19600 - Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts
CVE ID :CVE-2026-19600
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763
Severity: 4.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-19600
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763
Severity: 4.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-19621 - Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads
CVE ID :CVE-2026-19621
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted websocket event or the threads REST API.. Mattermost Advisory ID: MMSA-2026-00766
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-19621
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted websocket event or the threads REST API.. Mattermost Advisory ID: MMSA-2026-00766
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-75903 - Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials
CVE ID :CVE-2026-75903
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-75903
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-87111 - User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header
CVE ID :CVE-2026-87111
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-87111
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-96870 - SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
CVE ID :CVE-2026-96870
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-96870
Published : Oct. 16, 2026, 8:17 a.m. | 36 minutes ago
Description :The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...