🚨 CVE-2026-12234
The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net_msghdr into a kernel-side copy with k_usermode_from_copy(), but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow buffer is sized from one read of msg->msg_iovlen, while the population loop is bounded by a second, live read of the same field.
Because msg points into ordinary user memory, a cooperating second thread in the same memory domain can inflate msg->msg_iovlen in the window between the sizing read and the loop test (a classic double-fetch / TOCTOU). The population loop then iterates past the number of net_iovec slots actually allocated, writing attacker-influenced iov_base/iov_len values beyond the end of the kernel-heap shadow buffer. The recvmsg verifier has the same defect on both its inbound and result write-back loops.
The code is reachable from an unprivileged user thread whenever CONFIG_USERSPACE is enabled and the zsock_sendmsg/zsock_recvmsg syscalls are available. A successful race corrupts kernel-managed heap memory across the user-to-kernel privilege boundary, yielding a local privilege-escalation primitive or, at minimum, a kernel-fault denial of service. The fix copies the header once and derives every size, bound, and gate from the snapshot, copying each iovec entry atomically so its base and length can no longer be raced apart.
🎖@cveNotify
The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net_msghdr into a kernel-side copy with k_usermode_from_copy(), but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow buffer is sized from one read of msg->msg_iovlen, while the population loop is bounded by a second, live read of the same field.
Because msg points into ordinary user memory, a cooperating second thread in the same memory domain can inflate msg->msg_iovlen in the window between the sizing read and the loop test (a classic double-fetch / TOCTOU). The population loop then iterates past the number of net_iovec slots actually allocated, writing attacker-influenced iov_base/iov_len values beyond the end of the kernel-heap shadow buffer. The recvmsg verifier has the same defect on both its inbound and result write-back loops.
The code is reachable from an unprivileged user thread whenever CONFIG_USERSPACE is enabled and the zsock_sendmsg/zsock_recvmsg syscalls are available. A successful race corrupts kernel-managed heap memory across the user-to-kernel privilege boundary, yielding a local privilege-escalation primitive or, at minimum, a kernel-fault denial of service. The fix copies the header once and derives every size, bound, and gate from the snapshot, copying each iovec entry atomically so its base and length can no longer be raced apart.
🎖@cveNotify
GitHub
net: sockets: fix TOCTOU in recvmsg/sendmsg · zephyrproject-rtos/zephyr@2e0f9cf
z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() copy the user
msghdr into msg_copy but then re-read msg->msg_iovlen (and other
fields) live to size the allocation, bound the loop, and gate...
msghdr into msg_copy but then re-read msg->msg_iovlen (and other
fields) live to size the allocation, bound the loop, and gate...
🚨 CVE-2026-12235
The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llext_link_plt() (subsys/llext/llext_link.c), the relocatable branch (tgt != NULL, the path used for Xtensa relocatable objects) computed the patch address as ext->mem[LLEXT_MEM_TEXT] - text.sh_offset + rela.r_offset + tgt->sh_offset and then performed the relocation write there without validating rela.r_offset. Its sibling shared/dynamic branch already rejected out-of-range offsets via llext_file_offset().
rela.r_offset is read directly from the ELF's RELA table, so a crafted entry with an offset larger than the target section makes the write land arbitrarily far outside the extension's text buffer. The result is an attacker-influenced out-of-bounds write (the location via r_offset, the written value being the resolved symbol address) performed in supervisor context at link time, before any extension code runs.
The path is reached from llext_load() whenever an application loads an attacker-influenced ELF extension on Xtensa with writable storage; llext is documented to accept extensions of untrusted origin. Impact is supervisor-context memory corruption (integrity and availability loss, and a sandbox-boundary escape for user-mode extensions). Exploitation is gated by the Xtensa relocatable PLT path and writable storage, and turning the out-of-range write into a useful primitive is non-trivial.
The fix adds a bound check rejecting any RELA entry whose r_offset >= tgt->sh_size, mirroring the existing validation in the shared branch.
🎖@cveNotify
The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llext_link_plt() (subsys/llext/llext_link.c), the relocatable branch (tgt != NULL, the path used for Xtensa relocatable objects) computed the patch address as ext->mem[LLEXT_MEM_TEXT] - text.sh_offset + rela.r_offset + tgt->sh_offset and then performed the relocation write there without validating rela.r_offset. Its sibling shared/dynamic branch already rejected out-of-range offsets via llext_file_offset().
rela.r_offset is read directly from the ELF's RELA table, so a crafted entry with an offset larger than the target section makes the write land arbitrarily far outside the extension's text buffer. The result is an attacker-influenced out-of-bounds write (the location via r_offset, the written value being the resolved symbol address) performed in supervisor context at link time, before any extension code runs.
The path is reached from llext_load() whenever an application loads an attacker-influenced ELF extension on Xtensa with writable storage; llext is documented to accept extensions of untrusted origin. Impact is supervisor-context memory corruption (integrity and availability loss, and a sandbox-boundary escape for user-mode extensions). Exploitation is gated by the Xtensa relocatable PLT path and writable storage, and turning the out-of-range write into a useful primitive is non-trivial.
The fix adds a bound check rejecting any RELA entry whose r_offset >= tgt->sh_size, mirroring the existing validation in the shared branch.
🎖@cveNotify
GitHub
llext: bound-check r_offset in Xtensa PLT relocatable branch · zephyrproject-rtos/zephyr@106540a
The PLT relocation loop has two branches depending on whether the
ELF is relocatable (tgt != NULL) or shared/dynamic (tgt == NULL).
The shared branch already validates r_offset via llext_file_offs...
ELF is relocatable (tgt != NULL) or shared/dynamic (tgt == NULL).
The shared branch already validates r_offset via llext_file_offs...
🚨 CVE-2026-64954
Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider.
This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.
🎖@cveNotify
Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider.
This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.
🎖@cveNotify
🚨 CVE-2026-12976
The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.
🎖@cveNotify
The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.
🎖@cveNotify
WPScan
LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant
See details on LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant CVE 2026-12976. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-13168
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.
🎖@cveNotify
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.
🎖@cveNotify
WPScan
Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API
See details on Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API CVE 2026-13168. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-13171
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
🎖@cveNotify
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
🎖@cveNotify
WPScan
Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint
See details on Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint CVE 2026-13171. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-13177
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.
🎖@cveNotify
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.
🎖@cveNotify
WPScan
Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR
See details on Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR CVE 2026-13177. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-13612
The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.
🎖@cveNotify
The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.
🎖@cveNotify
WPScan
KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR
See details on KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR CVE 2026-13612. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-13613
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.
🎖@cveNotify
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.
🎖@cveNotify
WPScan
KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint
See details on KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint CVE 2026-13613. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-14857
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.
🎖@cveNotify
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.
🎖@cveNotify
WPScan
WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR
See details on WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR CVE 2026-14857. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-14858
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.
🎖@cveNotify
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.
🎖@cveNotify
WPScan
WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR
See details on WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR CVE 2026-14858. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-14859
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.
🎖@cveNotify
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.
🎖@cveNotify
WPScan
WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization
See details on WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization CVE 2026-14859. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-14925
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.
🎖@cveNotify
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.
🎖@cveNotify
WPScan
Import WP < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download
See details on Import WP < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download CVE 2026-14925. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-15039
The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.
🎖@cveNotify
The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.
🎖@cveNotify
WPScan
Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload
See details on Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload CVE 2026-15039. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-15249
The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.
🎖@cveNotify
The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.
🎖@cveNotify
WPScan
Patterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link
See details on Patterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link CVE 2026-15249. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-15388
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.
🎖@cveNotify
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.
🎖@cveNotify
WPScan
Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure
See details on Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure CVE 2026-15388. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-16051
The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution).
🎖@cveNotify
The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution).
🎖@cveNotify
WPScan
WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action
See details on WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action CVE 2026-16051. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-16066
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
🎖@cveNotify
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
🎖@cveNotify
WPScan
Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name
See details on Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name CVE 2026-16066. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-16253
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database.
🎖@cveNotify
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database.
🎖@cveNotify
WPScan
Total Upkeep (BoldGrid Backup) < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret…
See details on Total Upkeep (BoldGrid Backup) < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret (regression of CVE-2020-36848) CVE 2026-16253. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-16294
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.
🎖@cveNotify
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.
🎖@cveNotify
WPScan
Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL
See details on Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL CVE 2026-16294. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-16538
The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.
🎖@cveNotify
The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.
🎖@cveNotify
WPScan
TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up
See details on TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up CVE 2026-16538. View the latest Plugin Vulnerabilities on WPScan.