CVE-2026-124649

Lightbox with PhotoSwipe < 5.19.0 - Unauthenticated Stored XSS via Comment Link Title

The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources before inserting them as HTML into the image lightbox caption, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks via comments.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-116419

Sensitive Data Leakage via Log Files in Dell PowerScale InsightIQ

Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, containsan Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Powerscale Insightiq

CVE-2026-116430

Insufficient Verification of Data Authenticity Enables Information Tampering in Dell PowerScale InsightIQ

Dell PowerScale InsightIQ, Version 6.4.0, contain an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Powerscale Insightiq

CVE-2026-116420

Information Disclosure via Sensitive Data Logged in Dell PowerScale InsightIQ

Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, containsan Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Powerscale Insightiq

CVE-2026-116433

Missing Authorization Allowing Unauthorized Access in Dell PowerScale InsightIQ

Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Powerscale Insightiq

CVE-2026-123122

Checkout Files Upload for WooCommerce 2.4.0 - Unauthenticated Stored XSS via Uploaded File

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1 does not verify that a file uploaded at checkout is really one of its allowed image types, and serves stored uploads inline using their detected content type, allowing unauthenticated users to upload an HTML file disguised as an image that executes JavaScript in the browser of a shop manager or administrator who opens it from the order screen. This is a regression of CVE-2025-4212, reintroduced in 2.4.0.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-92735

Vault integrated storage join may disclose server environment credentials

HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2026-93335

Vault vulnerable to ACL deny bypass via trailing slash

Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2026-110331

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard and again poison elements in, or seize ownership of, dump directories while privileged ABRT handlers are processing them. Related Problems2 mutating methods remain ungated by the same check.

CVSS 3.1 · 7.8 High EPSS n/a KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Rhel Els

CVE-2026-123046

SEOJuice < 2.12.0 - Administrator Account Creation via CSRF

The SEOJuice WordPress plugin before 2.12.0 does not correctly restrict a REST API authentication filter, disabling WordPress's REST nonce protection for the whole site and allowing unauthenticated attackers to perform any cookie-authenticated REST action, including creating a new administrator account, by tricking a logged-in administrator into opening a crafted page (CSRF).

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-119258

Swipe <= 1.4 - Unauthenticated Authentication Bypass

The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress session cookie, allowing unauthenticated attackers to log in as an existing user, including an administrator, when that user has an active app session.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-118183

Copy & Delete Posts < 1.5.8 - Authenticated Post Publishing Restriction Bypass

The Duplicate Post WordPress plugin before 1.5.8 does not check whether a user may publish posts when duplicating one, allowing users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributors, to create published posts, including posts attributed to other users.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-118182

Copy & Delete Posts < 1.5.8 - Authenticated Arbitrary Post Slug Takeover

The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributor, to move any readable post off its permalink and publish their copy at that address.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-118181

Copy & Delete Posts < 1.5.8 - Authenticated Plugin Settings and Access Control Modification

The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, relying only on its own role-access list, which allows users of any role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, as low as Subscriber, to overwrite those settings, including the role-access list itself.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-117490

Flatsome < 3.20.13 - Contributor+ Post Type and Status Overwrite via ux_builder_save

The Flatsome WordPress theme before 3.20.13 does not enforce the acting user's publish and post-type restrictions on an AJAX save action, allowing users with a role as low as Contributor to publish their own content and change its post type (for example to a product) without holding the required capabilities.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-117487

Flatsome < 3.20.13 - Unauthenticated Unpublished Post Disclosure via flatsome_ajax_apply_shortcode

The Flatsome WordPress theme before 3.20.13 does not perform a capability or nonce check on an AJAX action available to unauthenticated users, and does not restrict the status of the posts it returns by ID, allowing unauthenticated users to disclose the content of unpublished (draft and pending) posts.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-116528

Chargely Free Subscriptions <= 1.0 - Unauthenticated WooCommerce REST API Credential Disclosure

The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check on a REST API route that returns its stored configuration, allowing unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret it holds, which grant read and write access to the whole store.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-105984

Email Marketing 4Dem <= 2.0.5 - Unauthenticated Configuration Destruction and Arbitrary Plugin Record Deletion

The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions, allowing unauthenticated users to destroy its stored configuration and delete its records.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-105983

Email Marketing 4Dem <= 2.0.5 - Unauthenticated Settings Modification and Configuration Disclosure

The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions and REST routes, allowing unauthenticated users to disclose the Email Marketing 4Dem WordPress plugin through 2.0.5's stored configuration and data and to modify its stored settings.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-111034

Countdown, Coming Soon, Maintenance – Countdown & Clock <= 3.0.8 - Subscriber+ Non-Public Post Title Disclosure via select2Ajax

The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not check that the user is allowed to browse content before returning post titles from one of its AJAX actions, allowing any authenticated user, such as a subscriber, to list the titles of published entries of any post type, including types that WordPress does not expose to them. Draft, private and pending content is not returned; only published entries are disclosed.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—