CVE Vulnerabilities - 11 October 2026

The X300 device’s ping diagnostic feature can be tricked into running system commands when a specially crafted host name is supplied. An attacker on the network could use this to execute arbitrary cod...

The AI Content Generator Marketing plugin for WordPress (through version 1.0.0) does not verify who is making certain background requests, so anyone on the internet can change or delete the site's set...

The Freeton WP WordPress plugin (up to version 1.0.0) does not properly check the activation code during login. This allows anyone who knows a user's email address to sign in as that user, including a...

The Mindstien Quick Login plug‑in for WordPress does not properly check a value it receives, so anyone can send a special request and gain the site’s administrator session. This gives an unauthenticat...

The click5 CRM add‑on for the Contact Form 7 WordPress plugin allows anyone on the internet to modify the site's configuration without logging in. This could be used to create a new administrator acco...

The click5 CRM add‑on for Gravity Forms (versions up to 1.0.3) does not verify who is making changes to its settings. Because of this, a stranger can alter any site option, including creating a new ad...

The click5 CRM add-on for WPForms (versions up to 1.0.3) lets anyone on the internet change any setting in your WordPress site because it lacks proper checks. This can be used to add a new administrat...

The click5 CRM add‑on for the Ninja Forms plugin in WordPress (up to version 1.0.1) does not verify who is making changes to its settings. Because of this, anyone on the internet can alter site option...

The Anton Extensions WordPress plugin up to version 1.2.2 does not check who is uploading files or what type of files are being added. This lets a stranger place a malicious script on your site and ta...

The Wukong HRM system lets any user call its HR functions without providing an authentication token. This means an attacker could view payslips, salary history, personal employee information, download...

The self‑hosted Docker setup for Agnai includes a fixed admin password and a public token secret. Because these values are hard‑coded, anyone can log in as an administrator, change settings, or impers...

BotSharp up to version 5.2.0 includes a default secret that is used to sign login tokens. Because the secret is fixed and publicly known, a remote attacker can create a valid token and act as any user...

The Insurify WordPress plugin (versions up to 1.0) allows anyone on the internet to trigger a request that removes important site settings. This can shut the website down and strip all users of their ...

The Quick Quotes add‑on for WordPress up to version 1.0.0 lets anyone on the internet send a special request that changes the plugin’s configuration. Because the request isn’t checked for permission, ...

The Insurify plugin for WordPress (versions up to 1.0) does not verify who is making certain requests, so anyone on the internet can change key settings. This can cause the whole site to go offline an...

The Fundiin plugin for WooCommerce on WordPress (versions up to 3.4.0) does not properly check who is making changes through its API, using the same default password on every site. Because of this, an...

The logging operator’s HTTP/2 server can mistakenly refund the same data twice—once when a client aborts a request and again when the server reads the buffered data. This miscount can lead to inaccura...

Versions 0.77.0 through 0.90.5 of Rill’s admin OAuth server let anyone register an application and receive a permanent access token without the user’s approval. This could let an attacker obtain a tok...