CVE Vulnerabilities - 11 October 2026

The X300 device’s ping diagnostic feature can be tricked into running system commands when a specially crafted host name is supplied. An attacker on the network could use this to execute arbitrary cod...

OpenSpug versions up to 3.4.0 and 4.0.1 have a weakness in the file transfer feature that can be tricked into running operating system commands. An attacker could exploit this from outside your networ...

The AI Content Generator Marketing plugin for WordPress (through version 1.0.0) does not verify who is making certain background requests, so anyone on the internet can change or delete the site's set...

The Freeton WP WordPress plugin (up to version 1.0.0) does not properly check the activation code during login. This allows anyone who knows a user's email address to sign in as that user, including a...

The Mindstien Quick Login plug‑in for WordPress does not properly check a value it receives, so anyone can send a special request and gain the site’s administrator session. This gives an unauthenticat...

The click5 CRM add‑on for the Contact Form 7 WordPress plugin allows anyone on the internet to modify the site's configuration without logging in. This could be used to create a new administrator acco...

The click5 CRM add‑on for Gravity Forms (versions up to 1.0.3) does not verify who is making changes to its settings. Because of this, a stranger can alter any site option, including creating a new ad...

The click5 CRM add-on for WPForms (versions up to 1.0.3) lets anyone on the internet change any setting in your WordPress site because it lacks proper checks. This can be used to add a new administrat...

The click5 CRM add‑on for the Ninja Forms plugin in WordPress (up to version 1.0.1) does not verify who is making changes to its settings. Because of this, anyone on the internet can alter site option...

The Anton Extensions WordPress plugin up to version 1.2.2 does not check who is uploading files or what type of files are being added. This lets a stranger place a malicious script on your site and ta...

The Wukong HRM system lets any user call its HR functions without providing an authentication token. This means an attacker could view payslips, salary history, personal employee information, download...

The self‑hosted Docker setup for Agnai includes a fixed admin password and a public token secret. Because these values are hard‑coded, anyone can log in as an administrator, change settings, or impers...

BotSharp up to version 5.2.0 includes a default secret that is used to sign login tokens. Because the secret is fixed and publicly known, a remote attacker can create a valid token and act as any user...

The Insurify WordPress plugin (versions up to 1.0) allows anyone on the internet to trigger a request that removes important site settings. This can shut the website down and strip all users of their ...

The Quick Quotes add‑on for WordPress up to version 1.0.0 lets anyone on the internet send a special request that changes the plugin’s configuration. Because the request isn’t checked for permission, ...

The Insurify plugin for WordPress (versions up to 1.0) does not verify who is making certain requests, so anyone on the internet can change key settings. This can cause the whole site to go offline an...

The Fundiin plugin for WooCommerce on WordPress (versions up to 3.4.0) does not properly check who is making changes through its API, using the same default password on every site. Because of this, an...

The logging operator’s HTTP/2 server can mistakenly refund the same data twice—once when a client aborts a request and again when the server reads the buffered data. This miscount can lead to inaccura...

The databasement library versions earlier than 1.8.2 let any logged‑in user specify a database name that is passed to system commands such as mariadb‑dump. This can be abused to write files to the web...

Versions 3.5.2 through 3.5.9 of Vearch do not correctly check permission levels, so users who should only view data can add, change, or delete records. This also lets them change their own role to gai...

The Piotnet Forms plugin for WordPress lets anyone upload files without checking who they are or what the file contains. A malicious file could run JavaScript in visitors' browsers, potentially steali...

The KeyWord Collector plugin for WordPress allows anyone to change its settings without checking who they are, and it does not protect the data it stores. Because of this, a malicious person can place...

The Topcontent WordPress plugin does not verify who can send content and disables HTML safety checks, so anyone on the internet can create posts that contain malicious JavaScript. Those scripts run in...

The Disable Users plugin for WordPress does not block all ways a user can sign in. As a result, an account that an administrator has marked as disabled can still be used to access the site with full r...

The SmugMug Embed WordPress plugin (versions up to 3.13) lets anyone without logging in store malicious code that is later shown on the plugin’s settings page. When an administrator opens that page, t...