CVE-2026-128893

WordPress Wise Chat plugin <= 3.4.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Reflected XSS.This issue affects Wise Chat: from n/a through 3.4.5.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125799

WordPress Flow-Flow Social Stream plugin <= 5.0.5 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Looks Awesome Flow-Flow Social Stream flow-flow-social-streams allows Retrieve Embedded Sensitive Data.This issue affects Flow-Flow Social Stream: from n/a through 5.0.5.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125447

WordPress Kali Forms plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Reflected XSS.This issue affects Kali Forms: from n/a through 2.4.31.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125733

WordPress ShopLentor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Reflected XSS.This issue affects ShopLentor: from n/a through 3.5.7.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-124747

Busybox: heap buffer overflow in wget ftp resume when the resume offset exceeds the reported file size

A flaw was found in BusyBox. When resuming a download over File Transfer Protocol (FTP), the wget utility fails to verify that the resume offset does not exceed the file size reported by the server, resulting in an integer calculation error. A malicious FTP server or an on-path network attacker can exploit this issue by returning crafted file size metadata, triggering a heap-based buffer overflow with attacker-controlled data. Successful exploitation may allow an attacker to execute arbitrary code or crash the application, resulting in a denial of service (DoS).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Busybox Red Hat Redhat

Products

Busybox Enterprise Linux Enterprise Linux and 3 more

CVE-2026-129469

Course-tencent-cloud before 2.0.2 IDOR via /api/refund/confirm

Course-tencent-cloud before 2.0.2 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to view other users' refund previews by supplying an order sn to /api/refund/confirm. Attackers can compute valid sn values from Sqids-encoded sequential order ids using the default key to disclose ordered items, prices, refund amounts, fees and deadlines.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Xiaochong0302

Products

Course-tencent-cloud

CVE-2026-64478

ALSA: usb-audio: avoid kobject path lookup in DualSense match

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the input device and the USB audio device, then comparing the path prefix. This was observed when a weak physical connection caused the controller to rapidly disconnect and reconnect. During that repeated hotplug, snd_dualsense_ih_match() can run while the controller's USB device is being disconnected. kobject_get_path() walks ancestor kobjects and dereferences their names; if the USB device kobject name is no longer valid, this can fault in strlen(): RIP: 0010:strlen+0x10/0x30 Call Trace: kobject_get_path+0x34/0x150 snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio] input_register_device+0x566/0x6a0 ps_probe+0xb89/0x1590 [hid_playstation] The same ownership check can be done without building kobject path strings. The input device is parented below the HID device, USB interface and USB device, so walking the input device parent chain and comparing against the mixer USB device preserves the check without dereferencing kobject names during disconnect.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-124561

D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow

A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-878 Dir-878

CVE-2026-124560

D-Link DIR-878 HNAP prog.cgi GetCAPTCHAsetting heap-based overflow

A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-878 Dir-878

CVE-2026-125780

WordPress Woocommerce Custom Product Addons Pro plugin <= 5.9.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Acowebs Woocommerce Custom Product Addons Pro woo-custom-product-addons-pro allows Path Traversal.This issue affects Woocommerce Custom Product Addons Pro: from n/a through 5.9.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125449

WordPress Testimonial Slider plugin <= 3.0.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Mamunur Rashid Testimonial Slider testimonial-slider-and-showcase allows Object Injection.This issue affects Testimonial Slider: from n/a through 3.0.2.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-124755

WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field advanced-custom-fields-font-awesome allows Stored XSS.This issue affects Advanced Custom Fields: Font Awesome Field: from n/a through 6.1.4.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125764

WordPress e2pdf plugin <= 1.32.65 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.65.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125805

WordPress GeoDirectory plugin <= 2.8.204 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through 2.8.204.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125791

WordPress Orphans plugin <= 3.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iWorks Orphans sierotki allows Stored XSS.This issue affects Orphans: from n/a through 3.4.6.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-124254

WordPress EWWW Image Optimizer plugin <= 8.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exactly WWW LLC EWWW Image Optimizer ewww-image-optimizer allows Stored XSS.This issue affects EWWW Image Optimizer: from n/a through 8.9.1.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125813

WordPress Survey Maker plugin <= 5.2.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Reflected XSS.This issue affects Survey Maker: from n/a through 5.2.4.3.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-124995

WordPress Track, Analyze & Optimize by WP Tao plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Stored XSS.This issue affects Track, Analyze & Optimize by WP Tao: from n/a through 1.3.1.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-124270

WordPress NEX-Forms plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.3.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125789

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.20 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Stored XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.20.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—