🚨 CVE-2026-81290
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Email Subscribers & Newsletters Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81297
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
🎖@cveNotify
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
🎖@cveNotify
Patchstack
Privilege Escalation in WordPress Fluent Forms Pro Add On Pack Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81298
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress LeadConnector Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81756
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
🎖@cveNotify
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
🎖@cveNotify
Patchstack
SQL Injection in WordPress Smart Marketing SMS and Newsletters Forms Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81762
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
🎖@cveNotify
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Booking and Rental Manager Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81764
Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Email Essentials Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81765
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Tailored Tools Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81768
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Super Store Finder Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81778
Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.
🎖@cveNotify
Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Kalles Addons Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81779
Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted.
This issue affects Newspapers X: from 1.0.46 through 1.0.48.
🎖@cveNotify
Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted.
This issue affects Newspapers X: from 1.0.46 through 1.0.48.
🎖@cveNotify
Patchstack
Backdoor in WordPress Newspapers X Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81887
Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __proto__, constructor, and prototype path segments and creates inherited objects. Client-side state handlers then access effects.html, effects.js, effects.xjs, and effects.scripts without Object.prototype.hasOwnProperty.call(), allowing inherited attacker-controlled state to be treated as trusted effects. An unauthenticated attacker can craft a URL that, when opened by a user, executes arbitrary JavaScript in the affected application's origin. Exploitation requires user interaction and does not bypass server-side authorization or grant privileges beyond the affected user. This issue is fixed in versions 3.8.3 and 4.3.4.
🎖@cveNotify
Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __proto__, constructor, and prototype path segments and creates inherited objects. Client-side state handlers then access effects.html, effects.js, effects.xjs, and effects.scripts without Object.prototype.hasOwnProperty.call(), allowing inherited attacker-controlled state to be treated as trusted effects. An unauthenticated attacker can craft a URL that, when opened by a user, executes arbitrary JavaScript in the affected application's origin. Exploitation requires user interaction and does not bypass server-side authorization or grant privileges beyond the affected user. This issue is fixed in versions 3.8.3 and 4.3.4.
🎖@cveNotify
GitHub
[3.x] Improve query string parsing and effect handling (#10467) · livewire/livewire@11ebe64
A full-stack framework for Laravel that takes the pain out of building dynamic UIs. - [3.x] Improve query string parsing and effect handling (#10467) · livewire/livewire@11ebe64
🚨 CVE-2026-81888
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.
🎖@cveNotify
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.
🎖@cveNotify
GitHub
fix(oauth-providers): fail closed on missing OAuth state to prevent l… · honojs/middleware@b37765f
…ogin CSRF (#2040)
* fix(oauth-providers): fail closed on missing OAuth state to prevent login CSRF
* changeset
* fix(oauth-providers): fail closed on missing OAuth state to prevent login CSRF
* changeset
🚨 CVE-2026-81889
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info['ip'], but get_remote_contents() selects fsock_get_contents(), which connects to $arr['host'] and performs a second DNS resolution. An attacker able to submit a URL upload can use DNS rebinding to have the first resolution return a public address and the connection resolution return a loopback or private address, causing the internal HTTP response body to be stored as an uploaded file and made readable through elFinder. After a successful fetch, get_headers($url, true) separately requests the original hostname without reusing the validated and pinned connection, creating an additional blind server-side request forgery path even when curl_get_contents() is selected. This issue is fixed in version 2.1.70.
🎖@cveNotify
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info['ip'], but get_remote_contents() selects fsock_get_contents(), which connects to $arr['host'] and performs a second DNS resolution. An attacker able to submit a URL upload can use DNS rebinding to have the first resolution return a public address and the connection resolution return a loopback or private address, causing the internal HTTP response body to be stored as an uploaded file and made readable through elFinder. After a successful fetch, get_headers($url, true) separately requests the original hostname without reusing the validated and pinned connection, creating an additional blind server-side request forgery path even when curl_get_contents() is selected. This issue is fixed in version 2.1.70.
🎖@cveNotify
GitHub
src build elFinder-2.1-4f0c06c3c · Studio-42/elFinder@191372c
📁 Open-source file manager for web, written in JavaScript using jQuery and jQuery UI - src build elFinder-2.1-4f0c06c3c · Studio-42/elFinder@191372c
🚨 CVE-2026-81890
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.
🎖@cveNotify
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.
🎖@cveNotify
GitHub
Merge commit from fork · Studio-42/elFinder@31284fa
* [php:connector] Protect netmount with CSRF validation
* Revert the automatic formatting
* Revert the automatic formatting
🚨 CVE-2026-81891
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.
🎖@cveNotify
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.
🎖@cveNotify
GitHub
src build elFinder-2.1-4f0c06c3c · Studio-42/elFinder@191372c
📁 Open-source file manager for web, written in JavaScript using jQuery and jQuery UI - src build elFinder-2.1-4f0c06c3c · Studio-42/elFinder@191372c