🚨 CVE-2026-28166
Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Tourmaster Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-28167
Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions.
🎖@cveNotify
Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions.
🎖@cveNotify
Patchstack
Arbitrary File Download in WordPress Super Forms Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-28171
Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.
🎖@cveNotify
Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.
🎖@cveNotify
Patchstack
Arbitrary File Deletion in WordPress WooCommerce File Approval Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32476
Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Brave Conversion Engine (PRO) Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32477
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
🎖@cveNotify
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
🎖@cveNotify
Patchstack
Arbitrary File Deletion in WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32558
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
🎖@cveNotify
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
🎖@cveNotify
Patchstack
Privilege Escalation in WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66584
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress 12 Step Meeting List Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66585
Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
🎖@cveNotify
Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
🎖@cveNotify
Patchstack
Sensitive Data Exposure in WordPress WP Cafe Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66599
Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress WPComplete Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66623
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Social Media & Share Icons Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-6017
Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal.
This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.
🎖@cveNotify
Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal.
This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.
🎖@cveNotify
cert.pl
Vulnerabilities in KAON PG5298A/PG5298B routers
CERT Polska has received a report about 2 vulnerabilities (CVE-2025-63080 and CVE-2026-6017) found in KAON PG5298A/PG5298B routers.
🚨 CVE-2026-78246
A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
🎖@cveNotify
A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
🎖@cveNotify
GitHub
itsourcecode Online Clinic Management System V1.0 SQL Injection Admin Authentication Bypass · Issue #63 · microwaveabi/vul
Description The admin login uses htmlspecialchars() with default ENT_COMPAT flag which only escapes double quotes, NOT single quotes. Combined with raw SQL concatenation and MD5 password hashing, t...