Skip to content
OpenAdvisories

Archive

11 April 2026

Vulnerabilities first published on this day (UTC), newest first.

← March 2026 2026 / April /11 May 2026 →
  1. 1242
  2. 2258
  3. 3226
  4. 463
  5. 5111
  6. 6256
  7. 7280
  8. 8490
  9. 9279
  10. 10223
  11. 1139
  12. 1257
  13. 13223
  14. 14415
  15. 15194
  16. 16142
  17. 17166
  18. 1833
  19. 1925
  20. 20180
  21. 21352
  22. 22343
  23. 23184
  24. 24281
  25. 2540
  26. 2679
  27. 27198
  28. 28221
  29. 29136
  30. 30170
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-23900

    Extension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for Joomla

    Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.

    phoca.cz phoca.cz - Phoca Maps for Joomla Web / CMS
  • Medium 4.3
    CVE-2026-3371

    Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the `save_course_content_order()` private m…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • Medium 5.0
    CVE-2026-4979

    UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter

    The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to blind Server-Side Request Forgery in all versions up to, and including, 1.2.58. This is due to insufficient URL origin …

    stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP Web / CMS
  • Medium 6.4
    CVE-2026-3498

    BlockArt Blocks <= 2.2.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'clientId' Block Attribute

    The BlockArt Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'clientId' block attribute in all versions up to, and including, 2.2.15. This is due to insufficient input sanitization and output escaping. This makes it possible f…

    wpblockart BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library Web / CMS
  • Medium 6.4
    CVE-2026-4895

    Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attribute

    The GreenShift - Animation and Page Builder Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 12.8.9 This is due to insufficient input sanitization and output escaping in the gspb_greenShift_block_scrip…

    wpsoul Greenshift – animation and page builder blocks Web / CMS
  • Medium 6.5
    CVE-2026-5207

    LifterLMS <= 9.2.1 - Authenticated (Custom+) SQL Injection via 'order' Parameter

    The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…

    chrisbadgett LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes Web / CMS
  • Medium 6.1
    CVE-2026-5226

    Optimole <= 4.2.3 - Reflected Cross-Site Scripting via Page Profiler URL

    The Optimole – Optimize Images in Real Time plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL paths in versions up to, and including, 4.2.3 This is due to insufficient output escaping on user-supplied URL paths in the get_current_ur…

    Optimole Optimole – Optimize Images in Real Time Web / CMS
  • Medium 5.4
    CVE-2026-3358

    Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing post_status validation in the `enroll_now()` and `course_enro…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • Medium 5.3
    CVE-2026-3691

    OpenClaw Client PKCE Verifier Information Disclosure Vulnerability

    OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target …

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-3689

    OpenClaw Canvas Path Traversal Information Disclosure Vulnerability

    OpenClaw Canvas Path Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenClaw. Authentication is required to exploit this vulnerability. The specific fla…

    OpenClaw OpenClaw openclaw npm