🚨 CVE-2026-87973
The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page.
🎖@cveNotify
The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page.
🎖@cveNotify
WPScan
If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name
See details on If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name CVE 2026-87973. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89296
The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
🎖@cveNotify
WPScan
Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter
See details on Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter CVE 2026-89296. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-90972
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.
🎖@cveNotify
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.
🎖@cveNotify
WPScan
WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion
See details on WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion CVE 2026-90972. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-90974
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.
🎖@cveNotify
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.
🎖@cveNotify
WPScan
WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update
See details on WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update CVE 2026-90974. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-92412
The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request, including a logged-in administrator.
🎖@cveNotify
The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request, including a logged-in administrator.
🎖@cveNotify
WPScan
Five Star Restaurant Reviews < 2.3.14 - Reflected XSS
See details on Five Star Restaurant Reviews < 2.3.14 - Reflected XSS CVE 2026-92412. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-96173
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.
🎖@cveNotify
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.
🎖@cveNotify
WPScan
Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR
See details on Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR CVE 2026-96173. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-96255
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials.
🎖@cveNotify
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials.
🎖@cveNotify
WPScan
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log
See details on Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log CVE 2026-96255. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-96577
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.
🎖@cveNotify
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.
🎖@cveNotify
Redhat
CVE-2026-96577 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-103082
Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.
🎖@cveNotify
Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.
🎖@cveNotify
Patchstack
Server Side Request Forgery (SSRF) in WordPress LA-Studio Element Kit for Elementor Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-103244
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.
🎖@cveNotify
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.
🎖@cveNotify
GitHub
feat(restore): implement memory-efficient full database restore with … · sgoudelis/ground-station@940df21
…streamed SQL processing
- Added support for streaming SQL statements from backup files to avoid loading entire files into memory.
- Introduced incremental schema creation, index deferral, and tra...
- Added support for streaming SQL statements from backup files to avoid loading entire files into memory.
- Introduced incremental schema creation, index deferral, and tra...
🚨 CVE-2026-103245
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and manipulate downstream actions like record creation or API calls.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and manipulate downstream actions like record creation or API calls.
🎖@cveNotify
GitHub
Missing Webhook Signature Verification in Webflow Trigger Node Allows Forged Event Injection
## Impact
The Webflow Trigger node accepted any HTTP POST to its webhook URL without verifying the `x-webflow-signature` HMAC that Webflow attaches to webhook deliveries. An unauthenticated atta...
The Webflow Trigger node accepted any HTTP POST to its webhook URL without verifying the `x-webflow-signature` HMAC that Webflow attaches to webhook deliveries. An unauthenticated atta...
🚨 CVE-2026-103246
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification.
🎖@cveNotify
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification.
🎖@cveNotify
GitHub
Inline Agent Node-Tool Introspection Decrypts Any Instance Credential Without Ownership Check
## Impact
Registering a node tool on an inline agent resolved the tool's input schema before the language model was consulted, and that resolution decrypted and used whatever credential the ca...
Registering a node tool on an inline agent resolved the tool's input schema before the language model was consulted, and that resolution decrypted and used whatever credential the ca...
🚨 CVE-2026-103247
n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to attacker-controlled hosts.
🎖@cveNotify
n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to attacker-controlled hosts.
🎖@cveNotify
GitHub
Duplicate Node IDs Bypass Workflow Credential Tamper Guard, Exposing Credentials to a Shared Workflow Editor
## Impact
Workflows shared with an editor keep credential-bearing nodes read-only, reverting on save any node that references a credential the editor cannot access. The revert matched nodes by id ...
Workflows shared with an editor keep credential-bearing nodes read-only, reverting on save any node that references a credential the editor cannot access. The revert matched nodes by id ...
🚨 CVE-2026-103248
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.
🎖@cveNotify
GitHub
Supabase Node Filters (String) Mode Allows PostgREST Filter Injection
## Impact
The Supabase node's "Filters (String)" mode inserted its field into the query sent to the database with no escaping, and the field accepts expressions. Where a workflow bui...
The Supabase node's "Filters (String)" mode inserted its field into the query sent to the database with no escaping, and the field accepts expressions. Where a workflow bui...
🚨 CVE-2026-103249
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor origin when other users open the node dropdown and click the external-link icon, with the payload persisting across workflow imports and shares.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor origin when other users open the node dropdown and click the external-link icon, with the payload persisting across workflow imports and shares.
🎖@cveNotify
GitHub
Stored DOM XSS via Resource Locator Dropdown Link Handling
## Impact
A Resource Locator parameter stores a URL that its dropdown offers as an external link, and that URL was opened without checking its scheme. A workflow author could set it to a script UR...
A Resource Locator parameter stores a URL that its dropdown offers as an external link, and that URL was opened without checking its scheme. A workflow author could set it to a script UR...
🚨 CVE-2026-103250
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations.
🎖@cveNotify
GitHub
NoSQL Injection in MongoDB Chat Memory Node Allows Unauthenticated Cross-Session Chat History Disclosure
## Impact
The MongoDB Chat Memory node accepted the sessionId value from the Chat Trigger request body without validating that it was a plain string before passing it to the MongoDB query that loa...
The MongoDB Chat Memory node accepted the sessionId value from the Chat Trigger request body without validating that it was a plain string before passing it to the MongoDB query that loa...
🚨 CVE-2026-103251
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum verification, and npm safety checks to install arbitrary npm packages across all cluster instances without authentication.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum verification, and npm safety checks to install arbitrary npm packages across all cluster instances without authentication.
🎖@cveNotify
GitHub
Community Package Install Validation Bypass via PubSub in Queue Mode Deployments
## Impact
In deployments using Redis for scaling (queue mode), the internal handler that installs a community package applied none of the checks the normal install path performs — name and prefix ...
In deployments using Redis for scaling (queue mode), the internal handler that installs a community package applied none of the checks the normal install path performs — name and prefix ...
🚨 CVE-2026-103252
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.
🎖@cveNotify
GitHub
Credential Test Endpoint Resolves Project-Scoped Variables from Attacker-Controlled Project ID
## Impact
The endpoint that tests a credential took the project used to resolve workflow variables from the request body, with no check that the caller may access that project. Because expressions...
The endpoint that tests a credential took the project used to resolve workflow variables from the request body, with no check that the caller may access that project. Because expressions...
🚨 CVE-2026-103253
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.
🎖@cveNotify
GitHub
SQL Injection in Oracle Database Node Delete Table Drop Operation
## Impact
The Oracle Database node's Delete Table → Drop operation inserts the table and schema values into a dynamically built PL/SQL statement without neutralising single quotes, so a quote ...
The Oracle Database node's Delete Table → Drop operation inserts the table and schema values into a dynamically built PL/SQL statement without neutralising single quotes, so a quote ...
🚨 CVE-2026-103254
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot access by exploiting unresolved traversal sequences in caller-controlled node IDs, enabling cross-project approval forgery.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot access by exploiting unresolved traversal sequences in caller-controlled node IDs, enabling cross-project approval forgery.
🎖@cveNotify
GitHub
Path Traversal in Signed Resume URL Generation Enables Cross-Project Approval Forgery
## Impact
The signed resume URL for a Send-and-Wait approval interpolated a caller-controlled node ID, and traversal sequences in it were resolved before signing. The signature covered only the pa...
The signed resume URL for a Send-and-Wait approval interpolated a caller-controlled node ID, and traversal sequences in it were resolved before signing. The signature covered only the pa...
🚨 CVE-2026-103255
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to traverse to Auth and Storage APIs using the administrative serviceRole key, bypassing Row Level Security and enabling unauthorized data access and modification.
🎖@cveNotify
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to traverse to Auth and Storage APIs using the administrative serviceRole key, bypassing Row Level Security and enabling unauthorized data access and modification.
🎖@cveNotify
GitHub
Path Traversal and Query Injection via the Supabase Node Table Name
## Impact
The Supabase node inserted the tableId parameter into the request path without validation, and the parameter accepts expressions, so it could be bound to untrusted input. A traversal seq...
The Supabase node inserted the tableId parameter into the request path without validation, and the parameter accepts expressions, so it could be bound to untrusted input. A traversal seq...