CVE-2026-87971

If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

If-so Dynamic Content

CVE-2026-96530

Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Optimole

CVE-2026-97188

String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

String Locator

CVE-2026-97331

User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

User Private Files

CVE-2026-97354

PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Powerpress

CVE-2026-86833

MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes

The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Metform

CVE-2026-105322

Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Magee Shortcodes

CVE-2026-82211

Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Nexi Xpay Build

CVE-2026-82212

Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Nexi Xpay Build

CVE-2026-102781

Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6

Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s core com_ajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to JFactory::getUser(), authorise(), or a CSRF token check exists anywhere in the handler. Two confirmed impact paths: an unauthenticated GET deletes any slider image by guessable sequential IDs, and an unauthenticated multipart upload with a zip file renames and replaces the entire #__os_touch_slider/#__os_touch_slider_text tables site-wide with attacker-supplied content, with no task parameter even required for the second path.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ordasoft.com

Products

Touch Slider Extension For Joomla

CVE-2026-90461

ironic: OpenStack Ironic: Information disclosure via unexpected credential transmission

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openstack

Products

Ironic

CVE-2026-102782

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic, non-sanitizing input filter, which strips HTML/script tags but never touches quotes or SQL syntax, and concatenates it directly into a query string with no escaping or parameterization:

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ordasoft.com

Products

Ordasoft Simple Membership Extension For Joomla

CVE-2026-89417

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the front-end server serves the retained .tmp file without a Content-Type or X-Content-Type-Options header, enabling MIME-sniffing browsers such as Chromium to execute the injected script — a condition present by default on many Apache and nginx/php-fpm deployments.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Daanvandenbergh Wordpress-extensions

Products

Omgf Omgf

CVE-2026-5703

Path Traversal in Satel Iberia SenNet Datalogger Serie 200

Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the URL to include a path traversal payload. Successful exploitation of this vulnerability could allow an attacker to access critical system files containing confidential information.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Satel-iberia Satel Iberia

Products

Sennet Datalogger Serie 200 Sennet Datalogger Serie 200

CVE-2026-92393

Apache YuniKorn: Admission control bypass via workload UPDATE operation

Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE action correctly enforces the checks for all object types. The bypass allows any user to specify an arbitrary user info annotation. The same bypass also allows changing the application ID for the workload. The combination of the two applied in one UPDATE could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue. Users are recommended to upgrade to version 1.10.0, which fixes this issue.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Yunikorn

CVE-2026-78243

Apache YuniKorn: LDAP Group provider panics on lowercase attribute name

Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record does not start with "CN=". This only affects install that have the non default LDAP group provider configured.  Users are recommended to upgrade to version 1.10.0, which fixes this issue.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Yunikorn

CVE-2026-97146

Apache YuniKorn: Admission control bypass via system label forgery

Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments. The bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue. Users are recommended to upgrade to version 1.10.0, which fixes this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Yunikorn

CVE-2026-42721

WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Servit Software Solutions Wordpress-extensions

Products

Affiliate-toolkit Affiliate-toolkit

CVE-2026-42720

WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Sarah Giles Wordpress-extensions

Products

Dynamic User Directory Dynamic User Directory

CVE-2026-96408

Unauthenticated Code Injection via Upgrade Script in Movable Type

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Six Apart

Products

Movable Type Movable Type Cloud Edition Movable Type Premium and 1 more