CVE-2026-81890
— elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConn…
elfinder
|
Remote
|
Cross-Site Request Forgery
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81889
— elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protecti…
elfinder
|
Remote
|
Server-Side Request Forgery
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81888
— @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF…
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, …
Remote
|
Cross-Site Request Forgery
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81887
— Livewire DOM-based cross-site scripting during client-side state handling
Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotN…
livewire
|
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81780
— WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81779
— WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability
Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted.
This issue affects Newspapers X: from 1.0.46 through 1.0.48.
Remote
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81778
— WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81768
— WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81765
— WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81764
— WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81763
— WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.
Remote
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81762
— WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
Remote
|
Authorization
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81758
— WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.
Remote
|
Authorization
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81756
— WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vuln…
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
Remote
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81298
— WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81297
— WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerabil…
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
Remote
|
Authorization
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81296
— WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerabi…
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
Remote
|
Authorization
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81293
— WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.
Remote
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81291
— WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
uncode
|
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81290
— WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) v…
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
