🚨 NewStatPress WordPress Plugin Exposes Admins to Stored XSS
WordPress administrators running NewStatPress 1.4.5 or earlier should prioritize updating to a fixed release when available. Because attackers need no authentication and can target administrator sessions, restrict access to the affected functionality or disable the plugin until remediation is available.
CVE-2026-101924 is a HIGH-severity stored cross-site scripting vulnerability affecting the NewStatPress WordPress plugin through version 1.4.5, with a CVSS score of 7.2. Insufficient output escaping in the ‘Last referrers’ section allows unauthenticated attackers to inject malicious JavaScript through recorded URL query strings. The payload executes when a privileged user, such as an administrator, visits the Overview page and hovers over the malicious link.
🔗 Read more 🔗
Source: NVD
⚠️ FV Flowplayer Video Player Plugin Vulnerable to Stored XSS
Site owners using FV Flowplayer should check whether the vulnerable parsing configuration is enabled and update to a fixed version as soon as one is available. Disable the affected option or avoid the vulnerable shortcode configuration in the meantime, particularly on public-facing sites.
CVE-2026-97398 is a HIGH-severity stored cross-site scripting vulnerability in the FV Flowplayer Video Player WordPress plugin, affecting versions through 7.5.54.7212, with a CVSS score of 7.2. Insufficient input sanitization and output escaping of the ‘synopsis’ shortcode attribute allow unauthenticated attackers to inject JavaScript that executes when visitors access affected pages. Exploitation requires the ‘Parse Vimeo and YouTube links’ option to be enabled and the liststyle attribute to be set to ‘season’.
🔗 Read more 🔗
Source: NVD
🚨 Gmedia Photo Gallery SQL Injection Exposes WordPress Databases
Administrators running Gmedia Photo Gallery 1.25.1 or earlier should treat this as an urgent database security issue. Apply a fixed release immediately when available, and restrict the vulnerable endpoint or disable the plugin until it can be secured. Disabling the Mobile App feature alone may not prevent exploitation.
CVE-2026-96661 is a HIGH-severity time-based SQL injection vulnerability affecting the Gmedia Photo Gallery WordPress plugin through version 1.25.1, with a CVSS score of 7.5. Attackers can manipulate the ‘gmedia__in’ parameter to execute additional SQL queries and potentially extract sensitive database information. The mobile app endpoint lacks authentication, nonce verification, and feature-flag enforcement, enabling exploitation without a WordPress account or session.
🔗 Read more 🔗
Source: NVD
🚨 Smart Forms WordPress Plugin Allows Unauthenticated Script Injection
Administrators using Smart Forms should prioritize remediation, particularly on websites accepting public form submissions. Enable the anonymous submission blocking option as an immediate mitigation and install a fixed release when available. Default configurations are especially exposed because attackers do not need authentication or a valid nonce.
CVE-2026-95816 is a HIGH-severity stored cross-site scripting vulnerability affecting the Smart Forms WordPress plugin through version 2.6.104, with a CVSS score of 7.2. Insufficient input sanitization and output escaping of the ‘formString’ parameter allow unauthenticated attackers to store malicious JavaScript that executes when users access affected pages. The vulnerable AJAX handler does not enforce nonce verification on default installations unless the anonymous submission blocking option is explicitly enabled.
🔗 Read more 🔗
Source: NVD
⚠️ Form Maker by 10Web Exposes Databases to Blind SQL Injection
Websites running Form Maker by 10Web 1.15.48 or earlier should prioritize updating to a fixed release when available. Public exposure of the nonce means it should not be treated as an effective authentication barrier. Consider temporarily disabling affected forms or the plugin and monitor database activity for suspicious queries.
CVE-2026-95808 is a HIGH-severity blind SQL injection vulnerability in the Form Maker by 10Web WordPress plugin, affecting versions through 1.15.48, with a CVSS score of 7.5. Insufficient SQL parameter handling allows unauthenticated attackers to manipulate the ‘inputs’ parameter and potentially retrieve sensitive database information. The required nonce is exposed in the source of public pages containing forms, making it readily accessible to attackers.
🔗 Read more 🔗
Source: NVD
🔓 Verified Reviews WordPress Plugin Hit by Authentication Bypass and XSS
Operators using Verified Reviews 2.4.6 or earlier should treat this as an urgent issue because attackers can bypass signature checks without valid credentials. Update to a fixed release when available, restrict access to the vulnerable endpoint, and monitor review moderation activity for suspicious requests or injected content.
CVE-2026-94377 is a HIGH-severity stored cross-site scripting vulnerability affecting the Verified Reviews (Avis Vérifiés) WordPress plugin through version 2.4.6, with a CVSS score of 7.2. Insufficient input sanitization and output escaping of the ‘moderation’ parameter allow unauthenticated attackers to inject JavaScript into pages viewed by users. An authentication bypass in the ntav_check_data() signature verification function uses loose comparisons, allowing specially crafted JSON boolean values to bypass verification on configured installations.
🔗 Read more 🔗
Source: NVD
🚨 Cryptocurrency Donation Box Plugin Vulnerable to Unauthenticated XSS
WordPress sites accepting cryptocurrency donations through this plugin should prioritize remediation. Update to a fixed version when available and consider disabling the donation functionality temporarily. The publicly exposed nonce offers no meaningful protection against unauthenticated attackers, so administrators should not rely on it to prevent exploitation.
CVE-2026-93885 is a HIGH-severity stored cross-site scripting vulnerability affecting the Cryptocurrency Donation Box WordPress plugin through version 2.2.13, with a CVSS score of 7.2. Attackers can inject malicious JavaScript through the data_object parameter because of insufficient input sanitization and output escaping. The vulnerable AJAX action is publicly accessible, while its nonce can be obtained from the wallets_data JavaScript object exposed by the donation shortcode.
🔗 Read more 🔗
Source: NVD
🚨 Critical JTL-Connector Flaw Enables Unauthenticated File Upload and Potential RCE
This deserves immediate attention from every WooCommerce operator using JTL-Connector 2.4.3 or earlier. Apply a fixed version as soon as available, and disable or isolate the connector until remediation is complete. Because unauthenticated remote code execution may be possible, inspect upload directories and server logs for suspicious activity and investigate affected systems for compromise.
CVE-2026-87855 is a CRITICAL arbitrary file upload vulnerability affecting the JTL-Connector for WooCommerce WordPress plugin through version 2.4.3, with a CVSS score of 9.8. The startSession() function incorrectly accepts an empty jtlauth parameter as valid authentication, while handleImagePush() fails to adequately validate uploaded file types. Unauthenticated attackers can upload potentially executable files through saveImage(), creating a path to remote code execution and possible server compromise.
🔗 Read more 🔗
Source: NVD
⚠️ Contact Form DB for Enfold Exposes WordPress Admins to Stored XSS
Administrators using Contact Form DB for Enfold should prioritize updating to a fixed version when available. Public contact forms create a straightforward route for attackers to submit malicious payloads targeting administrators who review submissions. Limit access to stored submissions and consider disabling the affected plugin until remediation is available.
CVE-2026-83592 is a HIGH-severity stored cross-site scripting vulnerability affecting the Contact Form DB for Enfold WordPress plugin through version 2.0.2, with a CVSS score of 7.2. Unauthenticated attackers can submit malicious JavaScript through contact form field values, which are later rendered without sufficient escaping in the administrative interface. The payload appears in both HTML title attributes and table cells, and its storage using Base64 encoding and serialization does not prevent execution.
🔗 Read more 🔗
Source: NVD
🚨 JTL-Connector for WooCommerce Hit by Unauthenticated SQL Injection
WooCommerce stores running JTL-Connector 2.4.3 or earlier should urgently remediate this issue, especially given the separate critical file upload vulnerability affecting the same plugin versions. Update to a fixed release when available or disable the connector while investigating exposure. Review database and application logs for abnormal requests targeting the product identity endpoint.
CVE-2026-78193 is a HIGH-severity time-based SQL injection vulnerability affecting the JTL-Connector for WooCommerce WordPress plugin through version 2.4.3, with a CVSS score of 7.5. Insufficient SQL query preparation at the ‘product.push’ identity endpoint allows unauthenticated attackers to inject additional SQL operations and potentially extract sensitive database information. The injection occurs during identity linking, before downstream product validation, meaning later request rejection does not prevent exploitation.
🔗 Read more 🔗
Source: NVD
⚠️ Document Gallery WordPress Plugin Exposes Logging-Enabled Sites to XSS
Administrators running Document Gallery should check whether logging is enabled and update to a fixed release when available. Disabling the affected logging functionality can reduce immediate exposure. Pay particular attention to development and staging environments with WP_DEBUG enabled, especially if they are publicly accessible.
CVE-2026-77114 is a HIGH-severity stored cross-site scripting vulnerability affecting the Document Gallery WordPress plugin through version 5.1.1, with a CVSS score of 7.2. Unauthenticated attackers can inject JavaScript through the ‘dg_thumber_webhook’ action request body, and the injected scripts execute when users access affected pages. Exploitation requires plugin logging to be enabled, which happens by default when WP_DEBUG is true or when an administrator manually enables logging.
🔗 Read more 🔗
Source: NVD
🚨 Nix and Lix Expression Evaluation Flaw Triggers Out-of-Bounds Memory Writes
Developers, build infrastructure operators, and CI/CD administrators using Nix or Lix should upgrade to Nix 2.35.3 or later and Lix 2.95.4 or later as a priority. Systems evaluating expressions from untrusted repositories or external contributors warrant especially urgent attention. Restrict untrusted expression evaluation until the affected installations have been updated.
CVE-2026-110449 is a HIGH-severity memory corruption vulnerability affecting Nix versions before 2.35.3 and Lix versions before 2.95.4, with a CVSS score of 7.5. An integer overflow during list allocation can cause an out-of-bounds write when the software evaluates untrusted expressions. The flaw creates a memory safety risk in environments that process untrusted Nix expressions.
🔗 Read more 🔗
Source: NVD