CVE-2026-53975

OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn() without any allowlist, blocklist, or argument validation. The authentication middleware becomes a no-op when UI_PASSWORD is not configured, matching the default Docker deployment, enabling attackers to execute arbitrary OS commands as the application user and retrieve full command output including stdout, stderr, and exit code from the server response.

CVSS 4.0 · 9.3 Critical EPSS 1.7% KEV · Not listed

Vendors

Bohdan Triapitsyn

Products

Openchamber

CVE-2026-53976

OpenChamber 1.11.7 Path Traversal File Read via allowOutsideWorkspace Parameter

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPathWithinRoot guard to read sensitive files such as the JWT signing secret, SSH private keys, API credentials, and environment variables, enabling full authentication bypass by forging session cookies on password-protected deployments.

CVSS 4.0 · 9.3 Critical EPSS 2.6% KEV · Not listed

Vendors

Bohdan Triapitsyn

Products

Openchamber

CVE-2026-28141

WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Syed Balkhi Wordpress

Products

Nextgen Gallery Wordpress

CVE-2026-28172

WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Data443 Risk Mitigation, Inc. Wordpress

Products

Tracking Code Manager Wordpress

CVE-2026-28179

WordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerability

Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Damian Góra Wordpress

Products

Fibosearch Wordpress

CVE-2026-32469

WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability

Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpkube

Products

Wordpress Captcha 4wp

CVE-2026-65504

WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ivanbebek Wordpress

Products

Box Now Delivery Croatia Wordpress

CVE-2026-65517

WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Scott Paterson Wordpress

Products

Easy Paypal Buy Now Button Wordpress

CVE-2026-65523

WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Approveme Wordpress

Products

Formidable Forms Signature Online Contract Automation Wordpress

CVE-2026-65541

WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Solutioned Wordpress

Products

Staff Training Wordpress

CVE-2026-65542

WordPress Super Socializer plugin <= 7.14.5 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Rajat Varlani Wordpress

Products

Super Socializer Wordpress

CVE-2026-65543

WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Vimeodev Wordpress

Products

Vimeo Wordpress

CVE-2026-65544

WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rajat Varlani Wordpress

Products

Super Socializer Wordpress

CVE-2026-65554

WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Lattepress Wordpress

Products

Anspress – Question And Answer Wordpress

CVE-2026-65556

WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mihche Wordpress

Products

Wpbruiser {no- Captcha Anti-spam} Wordpress

CVE-2026-65571

WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

69 Clothing Wordpress

CVE-2026-65572

WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

A.williams Wordpress

CVE-2026-66665

WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Brandexponents Wordpress

Products

Type Hub Wordpress

CVE-2026-66681

WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeff Farthing Wordpress

Products

Theme My Login Wordpress

CVE-2026-66683

WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Zone

Products

Wordpress Custom Css And Javascript