🚨 CVE-2026-32476
Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Brave Conversion Engine (PRO) Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32477
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
🎖@cveNotify
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
🎖@cveNotify
Patchstack
Arbitrary File Deletion in WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32558
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
🎖@cveNotify
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
🎖@cveNotify
Patchstack
Privilege Escalation in WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66584
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress 12 Step Meeting List Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66585
Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
🎖@cveNotify
Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
🎖@cveNotify
Patchstack
Sensitive Data Exposure in WordPress WP Cafe Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66599
Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress WPComplete Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66623
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Social Media & Share Icons Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-6017
Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal.
This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.
🎖@cveNotify
Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal.
This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.
🎖@cveNotify
cert.pl
Vulnerabilities in KAON PG5298A/PG5298B routers
CERT Polska has received a report about 2 vulnerabilities (CVE-2025-63080 and CVE-2026-6017) found in KAON PG5298A/PG5298B routers.
🚨 CVE-2026-78246
A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
🎖@cveNotify
A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
🎖@cveNotify
GitHub
itsourcecode Online Clinic Management System V1.0 SQL Injection Admin Authentication Bypass · Issue #63 · microwaveabi/vul
Description The admin login uses htmlspecialchars() with default ENT_COMPAT flag which only escapes double quotes, NOT single quotes. Combined with raw SQL concatenation and MD5 password hashing, t...
🚨 CVE-2026-78258
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Booking and Rental Manager Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78269
Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.
🎖@cveNotify
Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.
🎖@cveNotify
Patchstack
Server Side Request Forgery (SSRF) in WordPress Shared Files Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78272
Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
🎖@cveNotify
Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Fluent Support Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78277
Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
🎖@cveNotify
Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
🎖@cveNotify
Patchstack
Server Side Request Forgery (SSRF) in WordPress FluentCRM Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.