🚨 CVE-2026-73379
Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.
🎖@cveNotify
Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.
🎖@cveNotify
Patchstack
undefined in undefined undefined undefined
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-73380
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
🎖@cveNotify
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
🎖@cveNotify
Patchstack
PHP Object Injection in WordPress Popup by Supsystic Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-73381
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
🎖@cveNotify
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
🎖@cveNotify
Patchstack
Broken Authentication in WordPress Popup by Supsystic Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-73382
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Site Reviews Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-73393
Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Subscribe2 Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-73395
Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
🎖@cveNotify
Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
🎖@cveNotify
Patchstack
Insecure Direct Object References (IDOR) in WordPress Booking calendar, Appointment Booking System Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-73397
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
🎖@cveNotify
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
🎖@cveNotify
Patchstack
Deserialization of untrusted data in WordPress Youzify Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-73398
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.
🎖@cveNotify
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.
🎖@cveNotify
Patchstack
Broken Authentication in WordPress Piraeus Bank WooCommerce Payment Gateway Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-73399
Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.
🎖@cveNotify
Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.
🎖@cveNotify
Patchstack
Broken Authentication in WordPress Flutterwave WooCommerce Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-73400
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.
🎖@cveNotify
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.
🎖@cveNotify
Patchstack
undefined in undefined undefined undefined
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-73426
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.
🎖@cveNotify
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.
🎖@cveNotify
GitHub
Fix stored XSS via data-trix-serialized-attributes sanitizer bypass (… · basecamp/trix@3229c29
…H1 #3581911)
Strip `data-trix-serialized-attributes` in the DOMPurify `uponSanitizeAttribute`
hook before the `data-trix-*` force-keep logic runs.
This attribute is unique among `data-trix-*` at...
Strip `data-trix-serialized-attributes` in the DOMPurify `uponSanitizeAttribute`
hook before the `data-trix-*` force-keep logic runs.
This attribute is unique among `data-trix-*` at...
🚨 CVE-2026-73994
Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Charitable Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-73996
Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.
🎖@cveNotify
Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.
🎖@cveNotify
Patchstack
Arbitrary File Upload in WordPress Masteriyo - LMS Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-73997
Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.
🎖@cveNotify
Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.
🎖@cveNotify
Patchstack
Denial of Service Attack in WordPress Starter Templates by Kadence WP Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-74003
Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.
🎖@cveNotify
Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress RomethemeForm For Elementor Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-74004
Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions.
🎖@cveNotify
Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Gravity Booster – Styles & Layouts for Gravity Forms Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.