Skip to content
OpenAdvisories

Archive

28 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /28 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 5.5
    CVE-2026-28561

    wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates

    wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or…

    gVectors Team wpForo Forum
  • Medium 5.5
    CVE-2026-28560

    wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script

    wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script…

    gVectors Team wpForo Forum
  • Medium 5.3
    CVE-2026-28559

    wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed

    wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the…

    gVectors Team wpForo Forum
  • Medium 6.4
    CVE-2026-28558

    wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload

    wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScrip…

    gVectors Team wpForo Forum
  • Medium 6.5
    CVE-2026-28557

    wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler

    wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenti…

    gVectors Team wpForo Forum
  • Medium 5.4
    CVE-2026-28556

    wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers

    wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_move, topic_merge, and topic_split form action handlers. Attackers with a valid form nonce can reor…

    gVectors Team wpForo Forum
  • Medium 4.3
    CVE-2026-28555

    wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler

    wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator pe…

    gVectors Team wpForo Forum
  • Medium 4.3
    CVE-2026-28554

    wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler

    wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_approve_ajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with a…

    gVectors Team wpForo Forum
  • Medium 6.5
    CVE-2026-1542

    Super Stage WP <= 1.0.1 - Unauthenticated PHP Object Injection

    The Super Stage WP WordPress plugin through 1.0.1 unserializes user input via REQUEST, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.

    Web / CMS
  • Medium —
    GHSA-j8cj-hw74-64jv

    Hive has Double-free and Use After Free Vulnerabilities

    `Drop` implementation for `Hive` did perform free, but so did `Hive::close`, which, at the end of the scope performed `Drop`, therefore triggering double-free. Additionally, function `Hive::from_handle` was not marked as unsafe, making it, in combination with…

    hivex crates.io