Archive
2 September 2026
Vulnerabilities first published on this day (UTC), newest first.
326 results · Feed
-
Medium 6.8
All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block
The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack…
-
Medium 5.4
Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent mem…
-
Medium 4.8
Brave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter
The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-si…
-
Medium 5.3
Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization
The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerat…
-
Medium 5.3
RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account ho…
-
Critical 9.9
WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.
-
Medium 5.3
RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account.
-
Critical 10.0
Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.
-
Medium 6.5
CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attacker…
-
Low 3.5
GutenKit < 2.5.1 - Contributor+ Stored CSS Injection
The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages se…
-
Medium 5.3
WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuratio…
-
Medium 6.6
Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is rea…
-
Low 3.8
Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR
The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.
-
Low 3.5
Icegram Express < 5.8.6 - Admin+ Stored XSS
The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.
-
High 8.7
Arbitrary user password reset leading to administrator account takeover
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users per…
-
Medium 4.1
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
-
Medium 4.8
Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.
-
Critical 9.1
Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.
-
Medium 5.3
Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
-
Medium 5.3
Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.
-
Medium 5.4
External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.
-
Medium 5.3
Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.
-
Medium 5.9
Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100
Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.
-
Medium 5.9
Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100
Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.
-
Medium 5.9
Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100
Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.
-
Medium 5.9
Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101
Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.
-
High 7.3
Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102
Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.
-
High 7.3
Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102
Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.
-
Medium 4.8
Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.
-
Medium 5.3
Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104
Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.
-
Low 3.7
CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.
-
Low 3.7
Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106
Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.
-
Low 3.3
Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107
Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.
-
Medium 5.3
Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108
Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.
-
Medium 5.3
Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109
Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1.
-
Medium 5.3
DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to …
-
Medium 5.3
Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113
Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.
-
Medium 5.4
Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.
-
Medium 5.3
LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.
-
Medium 6.1
Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.