CVE-2026-14926

FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Fluentcart Wordpress

Products

A New Era Of Ecommerce Wordpress

CVE-2026-11756

Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x

A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Dassault Systèmes

Products

Station Launcher App In 3dexperience Platform

CVE-2026-55977

Bypass of application rate-limiting mechanism

Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the application's rate-limiting mechanism, enabling brute-forcing of the screen-sharing code and potentially displaying harmful content on the affected screen.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Eshare

Products

Esharepro

CVE-2026-8167

Reflected XSS in theWP's News Theme V8

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XSS. This issue affects News Theme V8: through 16.06.2026.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Thewp Digital Solutions Wordpress

Products

News Theme V8 Wordpress

CVE-2026-9680

MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Alibaba

Products

Alibaba Cloud Rds Openapi Mcp Server

CVE-2026-14167

ads-tec Industrial IT: Privilege escalation during configuration import

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ads-tec Industrial It Ads Tec

Products

Dvg-irf1401 Dvg-irf1421 Dvg-irf3401 and 5 more

CVE-2026-14168

ads-tec Industrial IT: Vertical privilege escalation via configuration table write

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ads-tec Industrial It Ads Tec

Products

Dvg-irf1401 Dvg-irf1421 Dvg-irf3401 and 5 more

CVE-2026-14169

ads-tec Industrial IT: Account lockout via non-atomic user creation

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ads-tec Industrial It Ads Tec

Products

Dvg-irf1401 Dvg-irf1421 Dvg-irf3401 and 5 more

CVE-2026-14171

ads-tec Industrial IT: Post-login open redirect in the web interface

An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ads-tec Industrial It Ads Tec

Products

Dvg-irf1401 Dvg-irf1421 Dvg-irf3401 and 5 more

CVE-2026-11841

CVE-2026-11841

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Sick Ag

Products

Inspectorp61x Inspectorp62x Inspectorp63x and 2 more

CVE-2026-10207

PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper escaping or prepared statements in the qa_user_profile_card() function. This makes it possible for unauthenticated attackers to append additional SQL queries into existing queries, which can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Pickplugins Wordpress

Products

Pickplugins Question Answer Wordpress

CVE-2026-14328

Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capability check — before returning the value of any arbitrary WordPress option via `get_option()`, combined with the `admin_login_endpoint_handler` REST endpoint (`GET /wp-json/epm/v1/admin/login`) being registered as publicly accessible and authenticating callers solely by a whirlpool hash of values stored in those same options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the `site_url`, `connection_key`, and `remote_user_id` values stored in the `eazywp_connecting_info` and `eazywp_connection` options, compute the required `auth_key`, call the `admin/login` REST endpoint to obtain Administrator authentication cookies, and fully take over the site. Exploitation requires the plugin's remote connection feature to have been configured, as the `eazywp_connecting_info` and `eazywp_connection` options must be populated with valid credentials.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Eazyplugins Wordpress

Products

Eazy Plugin Manager – Powerful Plugin Management Solution For Wordpress Wordpress

CVE-2026-11598

Shortcodify <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute

The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Lrnz Wordpress

Products

Shortcodify Wordpress

CVE-2026-14785

Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection

The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mihail-chepovskiy Wordpress

Products

Web Directory Free Wordpress

CVE-2026-18029

Insufficient validation of payment status in pretix-girosolution

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pretix Gmbh

Products

Pretix-girosolution

CVE-2026-13440

StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message_popup' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is possible because the 'ajd_protected' nonce required by the create_popup handler is exposed to all unauthenticated frontend visitors via wp_localize_script under bogo_save_url.ajd_nonce, effectively bypassing the nonce-only access control.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Storegrowth – Upsell, Bogo, Quick View, Direct Checkout & Side Cart For Woocommerce Wordpress

CVE-2026-13110

StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action

The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo_category_msg_create() AJAX handler, which is registered for both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) users and only validates a nonce ('ajd_protected') that is emitted publicly via wp_localize_script() on every frontend page through front_scripts() . This makes it possible for unauthenticated attackers to modify the plugin's BOGO category-message configuration stored in the spsg_bogo_general_settings option by reading the nonce from any public page and POSTing attacker-controlled data to admin-ajax.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Storegrowth – Upsell, Bogo, Quick View, Direct Checkout & Side Cart For Woocommerce Wordpress

CVE-2026-4648

Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands

Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. (version used at Resurrection Fest 2025), which employs cards based on MIFARE Classic technology (FM11RF08S). The cryptographic weakness of the authentication algorithm allows an attacker to retrieve access keys using techniques known as Backdoored Nested Attack, read the wristband’s entire contents, and clone its credentials onto a compatible rewritable card. Exploitation of this vulnerability could enable the impersonation of other attendees, the fraudulent use of the balance associated with their wristbands, and financial losses for both the affected users and the event organizers.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Casfid Servicios Tecnológicos

Products

Nfc Wristbands

CVE-2026-65882

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomdle.com

Products

Joomdle Component For Joomla

CVE-2026-65881

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Joomdle.com

Products

Joomdle Component For Joomla