CVE-2026-81763
— WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.
Remote
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81762
— WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
Remote
|
Authorization
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81758
— WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.
Remote
|
Authorization
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81756
— WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vuln…
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
Remote
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81298
— WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81297
— WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerabil…
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
Remote
|
Authorization
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81296
— WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerabi…
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
Remote
|
Authorization
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81293
— WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.
Remote
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81291
— WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
uncode
|
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81290
— WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) v…
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81287
— WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability
Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.
Remote
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81280
— WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sen…
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.
Remote
|
Information Disclosure
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81278
— WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Post SMTP: from 4.0.0 through beta.1.
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators …
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py.
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_meta_data() in metagpt/ext/spo…
|
Path Traversal
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-75594
— Kirby: Access to image files and limited access to JSON files outside of the site root vi…
Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb() to append a pat…
kirby
|
Remote
|
Path Traversal
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-75592
— Kirby: Access to image files outside of the site root via path traversal in the media han…
Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks in src/Filesystem/Dir.p…
kirby
|
Remote
|
Path Traversal
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-75460
— XueZhiSi Open Source Exam System Privilege Escalation Vulnerability
XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully cont…
|
Authorization
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-75458
— XueZhiSi Open Source Exam System Vertical Privilege Escalation
The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and t…
|
Authorization
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
