---METADATA---
VENDOR: n8n-io
PRODUCT: n8n
AFFECTED_VERSIONS: n8n-io n8n 0 up to (excluding) 1.123.64, 2.30.1, 2.29.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in n8n allows for the execution of malicious scripts via the cached result URL parameter.

Executive Summary:
n8n versions prior to 1.123.64, 2.30.1, and 2.29.8 are vulnerable to a stored cross-site scripting attack that could lead to unauthorized user actions.

Vulnerability Details

CVE-ID: CVE-2026-65592

Affected Software: n8n

Affected Versions: 0 up to (excluding) 1.123.64, 2.30.1, and 2.29.8

Vulnerability: This is a stored cross-site scripting (XSS) vulnerability (CWE-79) triggered via the cached result URL. An authenticated attacker can inject malicious scripts that execute in the context of other users, including administrators, when they view the affected data.

Business Impact

The CVSS score of 8.4 reflects the high risk of this vulnerability. An XSS attack can be used to hijack user sessions, perform unauthorized actions on behalf of the victim, or redirect users to malicious sites, potentially compromising the integrity of workflows managed within the n8n platform.

Remediation Plan

Immediate Action: Update n8n to version 1.123.64, 2.30.1, or 2.29.8 depending on your current deployment branch.

Proactive Monitoring: Monitor for suspicious script injections or unusual activity in workflow logs and user access logs.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the browser.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently exploitable by authenticated users, making it a critical concern for multi-user environments.

Analyst Recommendation

Administrators must prioritize updating their n8n instances to the specified fixed versions. Given the potential for session hijacking, ensuring that all users are on patched versions is essential to maintaining the security of workflow automations.

---METADATA---
VENDOR: n8n-io
PRODUCT: n8n
AFFECTED_VERSIONS: 0 up to 1.123.64, 2.30.1, 2.29.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler, allowing for potential expression language injection.

Executive Summary:
A high-severity expression language injection vulnerability in n8n allows authenticated attackers to bypass security sanitizers and achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-65591

Affected Software: n8n-io n8n

Affected Versions: Versions prior to 1.123.64, 2.30.1, and 2.29.8

Vulnerability: This vulnerability involves an improper neutralization of special elements in the legacy expression evaluator. An authenticated user can leverage this flaw to inject malicious expressions, leading to potential unauthorized code execution on the underlying host.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure, as it allows for arbitrary code execution with the privileges of the n8n service. This can lead to complete system compromise, unauthorized data exfiltration, and lateral movement within the network. Given the CVSS score of 8.9, this vulnerability is considered a critical priority for remediation.

Remediation Plan

Immediate Action: Update n8n to version 1.123.64, 2.30.1, or 2.29.8 depending on your current deployment branch.

Proactive Monitoring: Review audit logs for suspicious expression evaluations or attempts to access system-level files through workflow nodes.

Compensating Controls: Implement strict network segmentation for the n8n instance and ensure the service runs with the least privilege necessary to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires an authenticated attacker, which serves as a primary, though not absolute, defense against external mass-exploitation attempts.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Administrators must verify their current n8n version and apply the provided patches without delay to prevent potential remote code execution.

---METADATA---
VENDOR: Axiomthemes
PRODUCT: AI ANN
AFFECTED_VERSIONS: n/a through 1.29.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical PHP Object Injection vulnerability exists in the Axiomthemes AI ANN theme, allowing unauthenticated attackers to potentially execute arbitrary code.

Executive Summary:
A critical unauthenticated PHP Object Injection vulnerability in the Axiomthemes AI ANN theme enables remote attackers to compromise the integrity and availability of the affected system.

Vulnerability Details

CVE-ID: CVE-2026-65581

Affected Software: Axiomthemes AI ANN

Affected Versions: n/a through 1.29.0

Vulnerability: This flaw is a result of unsafe deserialization of untrusted data, specifically falling under CWE-502. An unauthenticated attacker can leverage this to inject malicious objects that lead to arbitrary code execution with the privileges of the web server.

Business Impact

The CVSS score of 9.8 underscores the severe potential for total system takeover. Exploitation of this vulnerability could lead to the theft of sensitive proprietary data, unauthorized modification of website content, and the potential for lateral movement into the wider internal network.

Remediation Plan

Immediate Action: Apply the latest security update released by Axiomthemes for the AI ANN theme to address the deserialization vulnerability.

Proactive Monitoring: Monitor web server logs for irregular query strings or POST requests that appear to contain serialized object signatures.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and block requests that attempt to exploit PHP deserialization vulnerabilities.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently exploitable by any remote user, making it a high priority for remediation.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency given its critical CVSS rating. Ensure the AI ANN theme is updated to the latest version immediately to close the injection vector and protect against potential remote exploitation.

---METADATA---
VENDOR: axiomthemes
PRODUCT: Agricola
AFFECTED_VERSIONS: n/a through 1.21.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An unauthenticated PHP Object Injection vulnerability exists in the axiomthemes Agricola theme, specifically affecting versions 1.21.0 and earlier.

Executive Summary:
A critical unauthenticated PHP Object Injection vulnerability in the axiomthemes Agricola theme allows for potential remote code execution, demanding immediate attention from security teams.

Vulnerability Details

CVE-ID: CVE-2026-65579

Affected Software: axiomthemes Agricola

Affected Versions: n/a through 1.21.0

Vulnerability: The theme fails to properly validate user-supplied input before deserializing it, which is classified as CWE-502. This allows an unauthenticated attacker to pass malicious serialized objects, which can then be used to execute arbitrary code on the server.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to business continuity and data security. An attacker could exploit this flaw to bypass all authentication mechanisms, steal database credentials, or deploy persistent backdoors within the application environment.

Remediation Plan

Immediate Action: Update the Agricola theme to the most recent version provided by axiomthemes to remediate the deserialization flaw.

Proactive Monitoring: Audit application logs for suspicious activity, including requests that attempt to pass serialized data to themes or plugins.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter incoming traffic and block payloads containing serialized PHP objects.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The ability to trigger this without authentication makes the threat highly accessible to attackers.

Analyst Recommendation

The presence of a known proof-of-concept, combined with the critical CVSS severity, necessitates an urgent response. Security teams should ensure that the Agricola theme is updated to a patched version immediately to prevent unauthorized access and potential remote code execution.

---METADATA---
VENDOR: AncoraThemes
PRODUCT: Agora
AFFECTED_VERSIONS: n/a through 1.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An unauthenticated PHP Object Injection vulnerability exists in AncoraThemes Agora versions 1.9 and earlier, allowing for potential remote code execution.

Executive Summary:
A critical unauthenticated PHP Object Injection vulnerability in the AncoraThemes Agora theme poses a severe risk of remote code execution and complete system compromise.

Vulnerability Details

CVE-ID: CVE-2026-65578

Affected Software: AncoraThemes Agora

Affected Versions: n/a through 1.9

Vulnerability: This vulnerability involves the insecure deserialization of untrusted data, categorized as CWE-502. It allows an unauthenticated attacker to inject malicious PHP objects, potentially leading to arbitrary code execution on the underlying server.

Business Impact

The CVSS score of 9.8 reflects the critical nature of this flaw, as it allows unauthenticated attackers to gain full control over the web application. Successful exploitation could lead to total data loss, unauthorized access to sensitive customer information, and significant reputational damage due to site defacement or malware distribution.

Remediation Plan

Immediate Action: Review the vendor's security updates and apply the latest version of the Agora theme as soon as it becomes available.

Proactive Monitoring: Monitor server access logs for anomalous requests, particularly those containing serialized PHP data structures or unexpected POST parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to block common PHP object injection patterns and malicious serialized payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to the lack of required authentication.

Analyst Recommendation

Given the critical severity and the potential for full system compromise without authentication, organizations using the Agora theme must prioritize this update. Administrators should verify the integrity of their WordPress installation immediately and prepare to deploy the vendor-supplied patch the moment it is released to mitigate the risk of exploitation.

---METADATA---
VENDOR: AncoraThemes
PRODUCT: Advice
AFFECTED_VERSIONS: n/a through 1.18.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The AncoraThemes Advice WordPress theme contains an unauthenticated PHP Object Injection flaw that could allow remote attackers to execute arbitrary code.

Executive Summary:
A critical PHP Object Injection vulnerability in the AncoraThemes Advice theme enables unauthenticated attackers to execute arbitrary code, posing a severe risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2026-65577

Affected Software: AncoraThemes Advice

Affected Versions: n/a through 1.18.0

Vulnerability: The theme is affected by CWE-502, Deserialization of Untrusted Data, which allows an attacker to inject malicious objects into the application. Because this is an unauthenticated vulnerability, it is accessible to any remote actor with network reach to the target web server.

Business Impact

The CVSS score of 9.8 highlights the critical nature of this flaw, as it permits full system compromise without any requirement for authentication. Successful exploitation may lead to total loss of confidentiality, integrity, and availability, potentially exposing customer data and impacting business operations.

Remediation Plan

Immediate Action: Update the Advice theme to the most recent version provided by AncoraThemes. In the event that an update is unavailable, ensure the theme is deactivated and removed from the server.

Proactive Monitoring: Review application logs for evidence of deserialization attempts or unusual system calls.

Compensating Controls: Implement a WAF to inspect incoming HTTP requests and block payloads that attempt to exploit PHP object deserialization.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the lack of authentication, making it a critical priority for remediation.

Analyst Recommendation

Given the critical severity of this vulnerability, administrators must act quickly to secure their systems. Ensure that the Advice theme is updated to the latest version to mitigate the risk of remote code execution and potential data compromise.

---METADATA---
VENDOR: AncoraThemes
PRODUCT: Adrena
AFFECTED_VERSIONS: n/a through 1.2.14
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The AncoraThemes Adrena WordPress theme is susceptible to unauthenticated PHP Object Injection, enabling remote attackers to execute arbitrary code by manipulating serialized data.

Executive Summary:
A critical PHP Object Injection vulnerability in the AncoraThemes Adrena theme allows unauthenticated remote attackers to execute arbitrary code and compromise the host system.

Vulnerability Details

CVE-ID: CVE-2026-65576

Affected Software: AncoraThemes Adrena

Affected Versions: n/a through 1.2.14

Vulnerability: This vulnerability involves CWE-502, Deserialization of Untrusted Data, where the application fails to validate serialized objects before processing them. As the vulnerability is unauthenticated, attackers can trigger the flaw remotely without needing legitimate user credentials.

Business Impact

A CVSS score of 9.8 reflects the extreme risk posed by this vulnerability, as it allows for complete system takeover. Organizations face significant risks including the theft of sensitive database information, injection of malicious scripts into the site, and potential lateral movement within the network infrastructure.

Remediation Plan

Immediate Action: Update the Adrena theme to the latest version immediately to address the deserialization flaw. If no patch is available, disable the theme to eliminate the attack vector.

Proactive Monitoring: Monitor server logs for anomalous activity and unexpected PHP execution patterns.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming traffic and block malformed serialized objects that target this vulnerability.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Although exploitation has not been confirmed, the nature of the flaw makes it a prime candidate for automated exploitation campaigns.

Analyst Recommendation

This vulnerability represents a critical security gap that requires immediate attention. Security teams should audit their WordPress installations to confirm if the Adrena theme is in use and apply the necessary updates to secure the application environment.

---METADATA---
VENDOR: AncoraThemes
PRODUCT: Accalia
AFFECTED_VERSIONS: n/a through 1.5.3
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The AncoraThemes Accalia WordPress theme is vulnerable to unauthenticated PHP Object Injection, allowing remote code execution via deserialization of untrusted user input.

Executive Summary:
A critical PHP Object Injection vulnerability in the AncoraThemes Accalia theme permits unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-65575

Affected Software: AncoraThemes Accalia

Affected Versions: n/a through 1.5.3

Vulnerability: The flaw is categorized as CWE-502, Deserialization of Untrusted Data, which occurs when an application deserializes untrusted data without sufficient verification. Because this vulnerability is reachable by unauthenticated attackers, it presents a severe risk to the integrity and availability of the host environment.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary PHP code, leading to full server compromise, data exfiltration, or complete site defacement. With a CVSS score of 9.8, this vulnerability is classified as critical, as it requires no user interaction or prior authentication, effectively providing a direct path for malicious actors to seize control of the underlying web server.

Remediation Plan

Immediate Action: Identify and update the Accalia theme to the latest available version provided by the vendor. If an update is not currently available, consider switching to a secure alternative or disabling the theme entirely until a patch is released.

Proactive Monitoring: Inspect web server access logs for suspicious serialized strings or unusual POST requests directed at theme-specific endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious object injection patterns and prevent common deserialization payloads from reaching the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this an exceptionally high-risk target for automated scanning and exploitation tools.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it allows for trivial remote code execution. Administrators must prioritize the identification of all instances of the Accalia theme within their environment and apply the latest vendor updates immediately to prevent unauthorized access.

---METADATA---
VENDOR: AncoraThemes
PRODUCT: Abogado
AFFECTED_VERSIONS: <= 1.18
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The AncoraThemes Abogado WordPress theme contains an unauthenticated PHP object injection vulnerability, which could lead to remote code execution.

Executive Summary:
A critical unauthenticated PHP object injection vulnerability in the AncoraThemes Abogado theme exposes the system to remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-65574

Affected Software: AncoraThemes Abogado

Affected Versions: <= 1.18

Vulnerability: This vulnerability involves the improper deserialization of untrusted data (CWE-502). Because the vulnerability is accessible to unauthenticated attackers, it provides a direct path for executing arbitrary PHP code on the server.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected system. Exploitation would likely result in total system compromise, potentially leading to widespread data breaches and loss of service control.

Remediation Plan

Immediate Action: Update the Abogado theme to the latest version provided by AncoraThemes. If a patched version is not yet available, temporarily disable the theme to mitigate the risk of exploitation.

Proactive Monitoring: Regularly review server and application logs for suspicious serialized strings. Monitor for unexpected modifications to system files or configuration settings.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block malicious deserialization attempts directed at the WordPress theme.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the absence of authentication requirements and the high level of technical impact.

Analyst Recommendation

The severity of this issue necessitates an immediate response, including the application of security patches as soon as they are made available. Organizations should perform an immediate assessment of their WordPress environments to ensure this theme is updated or properly secured.

---METADATA---
VENDOR: ThemeREX
PRODUCT: Abelle
AFFECTED_VERSIONS: <= 1.22
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The ThemeREX Abelle WordPress theme is susceptible to unauthenticated PHP object injection, potentially enabling remote code execution.

Executive Summary:
A critical unauthenticated PHP object injection flaw in the ThemeREX Abelle theme allows for potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-65573

Affected Software: ThemeREX Abelle

Affected Versions: <= 1.22

Vulnerability: The software contains a deserialization of untrusted data vulnerability (CWE-502) that can be triggered by an unauthenticated attacker. This flaw permits the injection of malicious objects, which can lead to arbitrary code execution within the WordPress environment.

Business Impact

The CVSS score of 9.8 reflects the high severity of this vulnerability, as it allows remote attackers to gain control over the affected application. This could result in the theft of database credentials, unauthorized access to user data, and the deployment of malware.

Remediation Plan

Immediate Action: Apply the latest security update released by ThemeREX for the Abelle theme. If an official update is not available, remove the theme from the production environment to eliminate the attack surface.

Proactive Monitoring: Audit server logs for requests that attempt to pass serialized data to theme functions. Monitor application performance for signs of unauthorized background processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter out malicious traffic that targets deserialization entry points.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this vulnerability highly attractive to automated scanning tools.

Analyst Recommendation

Given the critical nature of this vulnerability, immediate patching is required to prevent unauthorized system access. Security teams should verify that the theme is updated to the latest version and ensure that no malicious artifacts persist on the server.

---METADATA---
VENDOR: Axiomthemes
PRODUCT: A.Williams
AFFECTED_VERSIONS: <= 1.3.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Axiomthemes A.Williams WordPress theme is vulnerable to unauthenticated PHP object injection, which may allow remote code execution.

Executive Summary:
A critical unauthenticated PHP object injection vulnerability in the Axiomthemes A.Williams theme poses a severe risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-65572

Affected Software: Axiomthemes A.Williams

Affected Versions: <= 1.3.1

Vulnerability: The vulnerability is a PHP object injection flaw (CWE-502) caused by the deserialization of untrusted user input. Because the attack vector is network-based and requires no authentication, an attacker can execute arbitrary code on the underlying server.

Business Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to achieve full system compromise. Given the CVSS score of 9.8, the potential impact includes unauthorized access to sensitive data, complete loss of system integrity, and total service disruption.

Remediation Plan

Immediate Action: Update the Axiomthemes A.Williams theme to the latest available version provided by the vendor. If a patch is not yet available, consider disabling the theme until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing serialized PHP objects or suspicious payloads. Monitor system resource utilization for unexpected spikes that may indicate unauthorized code execution.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common PHP object injection patterns and malicious input strings.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This flaw is inherently dangerous due to its unauthenticated nature and the potential for remote code execution.

Analyst Recommendation

This vulnerability represents a critical security risk due to its potential for full system compromise without requiring user credentials. Administrators should prioritize updating the affected theme immediately and verify that no unauthorized modifications have been made to the WordPress installation.

---METADATA---
VENDOR: Axiomthemes
PRODUCT: 69 Clothing
AFFECTED_VERSIONS: up to and including 1.2.11.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The 69 Clothing WordPress theme is affected by an unauthenticated PHP object injection vulnerability, which enables attackers to execute arbitrary code through the deserialization of untrusted input.

Executive Summary:
A critical PHP object injection vulnerability in the 69 Clothing theme allows unauthenticated attackers to perform remote code execution, threatening the integrity and security of the entire web server.

Vulnerability Details

CVE-ID: CVE-2026-65571

Affected Software: Axiomthemes 69 Clothing

Affected Versions: up to and including 1.2.11.1

Vulnerability: The theme improperly handles deserialization of untrusted data (CWE-502). This flaw allows an unauthenticated attacker to inject malicious PHP objects, which can lead to remote code execution and full application compromise.

Business Impact

The potential impact of this vulnerability is critical, as it allows attackers to bypass authentication and gain full control over the website. This could lead to the theft of customer information, unauthorized site modifications, or the deployment of malware, causing severe damage to the organization's reputation and financial health. The 9.8 CVSS score reflects the extreme risk posed to the confidentiality, integrity, and availability of the affected system.

Remediation Plan

Immediate Action: Update the 69 Clothing theme to the latest version as soon as a security patch is provided by the developer, or consider switching to an alternative, secure theme if a fix is not forthcoming.

Proactive Monitoring: Implement robust logging and review access logs for unusual activity that might signify an attempt to exploit deserialization vulnerabilities.

Compensating Controls: Deploy a Web Application Firewall (WAF) to intercept and block requests that attempt to exploit the deserialization process.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is currently not confirmed as active, the technical nature of the flaw makes it highly susceptible to weaponization.

Analyst Recommendation

Due to the critical severity and the potential for unauthenticated remote code execution, this issue requires urgent attention. Organizations should monitor the vendor for a security update and apply it immediately upon release to secure their infrastructure against potential exploitation.

---METADATA---
VENDOR: Hamid Alinia
PRODUCT: Login with phone number
AFFECTED_VERSIONS: n/a through 1.8.70
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Login with phone number WordPress plugin contains an authentication bypass vulnerability, allowing unauthenticated attackers to spoof identity and gain unauthorized access.

Executive Summary:
An authentication bypass vulnerability in the Login with phone number WordPress plugin allows unauthenticated attackers to gain unauthorized access to the system.

Vulnerability Details

CVE-ID: CVE-2026-65570

Affected Software: Hamid Alinia Login with phone number

Affected Versions: n/a through 1.8.70

Vulnerability: This is an authentication bypass vulnerability (CWE-290) resulting from improper validation of authentication credentials. It allows an unauthenticated attacker to successfully authenticate by spoofing the login process.

Business Impact

The vulnerability carries a CVSS score of 8.1, reflecting its potential for full account takeover. By bypassing the login mechanism, attackers can gain unauthorized access to user accounts, including administrative accounts, leading to total compromise of the affected WordPress site and its data.

Remediation Plan

Immediate Action: Update the Login with phone number plugin to version 1.8.71 or higher immediately.

Proactive Monitoring: Audit WordPress user account logs for suspicious account creations, privilege escalations, or unauthorized logins occurring during the period the vulnerable plugin was active.

Compensating Controls: If immediate patching is not possible, deactivate the plugin and utilize alternative authentication methods until the update can be verified and applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is severe due to the ease of bypassing identity verification.

Analyst Recommendation

This is a critical security update for any WordPress environment using the Login with phone number plugin. Administrators must apply the update to version 1.8.71 immediately to close this authentication bypass vector and prevent potential account takeovers.

---METADATA---
VENDOR: WP Job Portal
PRODUCT: WP Job Portal
AFFECTED_VERSIONS: n/a through 2.5.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The WP Job Portal plugin for WordPress contains an SQL injection vulnerability that allows authenticated subscribers to execute arbitrary database queries.

Executive Summary:
An authenticated SQL injection vulnerability in the WP Job Portal plugin enables low-privileged subscribers to compromise database confidentiality through malicious query execution.

Vulnerability Details

CVE-ID: CVE-2026-65569

Affected Software: WP Job Portal

Affected Versions: n/a through 2.5.6

Vulnerability: The plugin fails to properly sanitize user-supplied input before using it in SQL queries (CWE-89). Authenticated subscribers can exploit this to bypass intended data access restrictions and perform unauthorized database operations.

Business Impact

Exploitation of this vulnerability allows unauthorized access to data stored within the WordPress database, such as user information, application details, or configuration settings. This could lead to a significant breach of privacy and potential reputational damage. The CVSS score of 8.5 underscores the critical nature of this vulnerability.

Remediation Plan

Immediate Action: Update the WP Job Portal plugin to version 2.5.7 or later to remediate the vulnerability.

Proactive Monitoring: Monitor database query logs for suspicious patterns or unexpected syntax that may indicate an ongoing attempt to exploit SQL injection vulnerabilities.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious traffic and block requests containing SQL injection payloads before they reach the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SQL injection flaws are frequently targeted due to the high value of data stored in backend databases.

Analyst Recommendation

The availability of a patch makes remediation straightforward. All administrators are advised to update the WP Job Portal plugin to version 2.5.7 immediately to mitigate the risk of unauthorized database access. Verify that the update is successful by checking the plugin version in the WordPress dashboard.

---METADATA---
VENDOR: MihChe
PRODUCT: WPBruiser {no- Captcha anti-Spam}
AFFECTED_VERSIONS: up to and including 3.1.43
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The WPBruiser {no- Captcha anti-Spam} WordPress plugin is vulnerable to unauthenticated PHP object injection, enabling attackers to execute arbitrary code via the deserialization of untrusted data.

Executive Summary:
A critical PHP object injection vulnerability in the WPBruiser {no- Captcha anti-Spam} plugin allows unauthenticated attackers to gain remote code execution and compromise the host environment.

Vulnerability Details

CVE-ID: CVE-2026-65556

Affected Software: MihChe WPBruiser {no- Captcha anti-Spam}

Affected Versions: up to and including 3.1.43

Vulnerability: The plugin fails to properly validate input during deserialization (CWE-502). An unauthenticated attacker can leverage this flaw to inject malicious objects, which can trigger arbitrary code execution within the context of the WordPress installation.

Business Impact

Successful exploitation allows an attacker to seize control of the web application, leading to complete data exfiltration, modification of site content, or the installation of persistent backdoors. Given the 9.8 CVSS score, the impact on confidentiality, integrity, and availability is total, creating a significant risk to organizational data security and service continuity.

Remediation Plan

Immediate Action: Update the WPBruiser {no- Captcha anti-Spam} plugin to the latest available version if a patch has been issued, or deactivate the plugin immediately if no update is currently available.

Proactive Monitoring: Monitor application logs for anomalous requests, particularly those containing serialized PHP objects, which may indicate an attempt to exploit this vulnerability.

Compensating Controls: Use a Web Application Firewall (WAF) to filter incoming traffic and block requests containing suspicious serialized data patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to its potential for unauthenticated remote code execution.

Analyst Recommendation

This vulnerability is highly critical and presents an immediate threat to the security of affected WordPress sites. Administrators should take swift action to update the plugin or remove it from the production environment to eliminate the risk of total system compromise.

---METADATA---
VENDOR: wbolt.com
PRODUCT: Spider Analyser
AFFECTED_VERSIONS: 2.1.3 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Spider Analyser WordPress plugin contains an unauthenticated Remote Code Execution vulnerability, allowing attackers to execute arbitrary code on the underlying server.

Executive Summary:
An unauthenticated Remote Code Execution flaw in the Spider Analyser WordPress plugin poses a critical risk of total system takeover.

Vulnerability Details

CVE-ID: CVE-2026-65553

Affected Software: wbolt.com Spider Analyser (WordPress plugin)

Affected Versions: Versions 2.1.3 and earlier

Vulnerability: This is a code injection vulnerability (CWE-94) that allows an unauthenticated remote attacker to execute arbitrary code. The vulnerability stems from insufficient sanitization of input, which is reachable by any external user.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code on a server is a worst-case scenario. With a CVSS score of 10.0, this vulnerability allows for complete system compromise, including data exfiltration, modification of site content, and potential lateral movement within the hosting environment.

Remediation Plan

Immediate Action: If a security update is not yet available from the vendor, immediately deactivate and remove the Spider Analyser plugin from all WordPress installations.

Proactive Monitoring: Inspect web server and application logs for unusual file execution attempts or suspicious outbound network traffic originating from the web server.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common code injection patterns and restrict access to administrative interfaces.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it highly attractive to automated exploitation tools.

Analyst Recommendation

Due to the critical nature of this RCE and the lack of a confirmed patch, the safest course of action is the immediate removal of the plugin. Organizations should treat this as a high-priority incident and audit their environments for any signs of post-exploitation activity.

---METADATA---
VENDOR: qstudio
PRODUCT: Export User Data
AFFECTED_VERSIONS: up to and including 2.2.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Export User Data WordPress plugin is vulnerable to PHP object injection, which allows unauthenticated attackers to execute arbitrary code or manipulate data via deserialization of untrusted input.

Executive Summary:
A critical PHP object injection vulnerability in the Export User Data plugin for WordPress allows unauthenticated attackers to achieve remote code execution and full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-65552

Affected Software: qstudio Export User Data

Affected Versions: up to and including 2.2.6

Vulnerability: This flaw stems from improper deserialization of untrusted data (CWE-502). It permits unauthenticated attackers to inject malicious PHP objects into the application, potentially leading to arbitrary code execution.

Business Impact

The exploitation of this vulnerability poses a severe threat to business operations, as it grants attackers the ability to execute arbitrary code with the privileges of the web server. This can lead to total system compromise, unauthorized access to sensitive user data, and significant reputational damage. With a CVSS score of 9.8, this vulnerability is classified as critical and requires immediate attention to prevent full service takeover.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately deactivate and remove the Export User Data plugin until a secure version is released by the vendor.

Proactive Monitoring: Review web server and application logs for suspicious serialized strings or unusual PHP error patterns that might indicate attempted deserialization attacks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious object injection attempts, though this should be considered a temporary measure until the software is removed or updated.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of a vendor-supplied patch necessitates the immediate deactivation of the plugin to mitigate the risk of remote code execution.

Analyst Recommendation

Given the critical nature of this deserialization flaw and the absence of a vendor-provided fix, the risk is unacceptably high. Organizations must prioritize the removal of this plugin from their WordPress environments immediately to prevent potential unauthorized access and system exploitation.

---METADATA---
VENDOR: ProSolution
PRODUCT: WP Client
AFFECTED_VERSIONS: Up to and including 2.0.0
---END_METADATA---

Description Summary:
The ProSolution WP Client WordPress plugin is vulnerable to arbitrary file upload due to improper validation of the upload array, allowing remote code execution.

Executive Summary:
A critical arbitrary file upload vulnerability in the ProSolution WP Client WordPress plugin allows unauthenticated attackers to execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-6555

Affected Software: ProSolution WP Client for WordPress

Affected Versions: Up to and including 2.0.0

Vulnerability: The plugin fails to validate all files in an upload array, only checking the first one. An unauthenticated attacker can bypass these checks to upload malicious PHP files to a web-accessible directory.

Business Impact

A CVSS score of 9.8 indicates an extremely high level of risk. An attacker can use this flaw to gain full control of the WordPress instance, potentially leading to the compromise of user databases and the use of the server for malicious activity.

Remediation Plan

Immediate Action: Update the ProSolution WP Client plugin to the latest version. Check the vendor security advisory for specific patch details.

Proactive Monitoring: Review web server logs for suspicious file upload requests and scan the site for unauthorized PHP scripts.

Compensating Controls: Configure the web server to disable script execution in the directory where user files are uploaded.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is a prime example of why input validation must be exhaustive across all data inputs. Immediate updates are required, and organizations should scan their web directories for any signs of unauthorized file activity.

---METADATA---
VENDOR: Muffingroup
PRODUCT: Betheme
AFFECTED_VERSIONS: n/a through 28.4.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical remote code execution vulnerability exists in the Betheme WordPress theme, allowing authenticated contributors to execute arbitrary code on the underlying server.

Executive Summary:
The Betheme WordPress theme contains a critical vulnerability that allows authenticated contributors to achieve remote code execution on the host server.

Vulnerability Details

CVE-ID: CVE-2026-65548

Affected Software: Muffingroup Betheme

Affected Versions: All versions up to and including 28.4.2

Vulnerability: The vulnerability is an improper control of code generation, allowing an attacker with contributor-level access to inject and execute arbitrary code. This bypasses typical theme restrictions and grants the attacker significant control over the WordPress instance.

Business Impact

An attacker with contributor access can escalate their privileges to full system control, leading to complete site compromise, data exfiltration, or the deployment of persistent malware. Given the CVSS score of 9.9, this vulnerability poses an extreme threat to the integrity and availability of the entire web server environment.

Remediation Plan

Immediate Action: Update the Betheme theme to the latest available version that addresses this vulnerability. If an update is not yet available, restrict contributor access or disable the theme until a patch is applied.

Proactive Monitoring: Review WordPress user logs for suspicious activity by contributors and monitor server file integrity for unauthorized modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious code injection attempts targeting WordPress themes.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable for any user with contributor privileges.

Analyst Recommendation

Security teams should audit their WordPress installations to identify the use of Betheme and enforce immediate updates. Restricting administrative and contributor access remains a vital defense-in-depth measure until the vendor provides a verified patch.

---METADATA---
VENDOR: Constant Contact
PRODUCT: Creative Mail
AFFECTED_VERSIONS: n/a through 1.6.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Constant Contact Creative Mail plugin for WordPress is susceptible to SQL injection, allowing authenticated subscribers to execute unauthorized database queries.

Executive Summary:
An authenticated SQL injection vulnerability in the Creative Mail plugin exposes the underlying database to unauthorized manipulation by low-privileged subscribers.

Vulnerability Details

CVE-ID: CVE-2026-65547

Affected Software: Constant Contact Creative Mail

Affected Versions: n/a through 1.6.9

Vulnerability: This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89). Authenticated subscribers can inject malicious SQL code, which is then executed by the database, potentially exposing sensitive information.

Business Impact

An attacker with subscriber-level access can leverage this flaw to extract sensitive database content, including user credentials or marketing data. This represents a significant risk to data confidentiality. While the CVSS score is 8.5, the impact is highly dependent on the database permissions assigned to the web application.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately deactivate or uninstall the Creative Mail plugin until a fix is released by the vendor.

Proactive Monitoring: Enable database query logging and monitor for anomalous or highly complex SQL queries originating from the application layer.

Compensating Controls: Utilize a Web Application Firewall (WAF) configured to inspect and block inputs containing SQL syntax to mitigate the risk of injection attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SQL injection remains a primary vector for data exfiltration, necessitating strict input validation.

Analyst Recommendation

The absence of a vendor-provided patch necessitates immediate defensive action. Organizations relying on Creative Mail should remove the plugin to eliminate the exposure until the vendor provides a secure update. Monitor vendor security bulletins closely for the release of a patched version.

---METADATA---
VENDOR: Rajat Varlani
PRODUCT: Super Socializer
AFFECTED_VERSIONS: n/a through 7.14.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A broken authentication vulnerability in the Super Socializer plugin allows unauthenticated attackers to bypass security controls via an alternate path or channel.

Executive Summary:
An unauthenticated authentication bypass vulnerability in the Super Socializer plugin poses a high risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-65542

Affected Software: Rajat Varlani Super Socializer

Affected Versions: n/a through 7.14.5

Vulnerability: The plugin suffers from an authentication bypass (CWE-288) that allows an unauthenticated attacker to circumvent standard login requirements. This flaw effectively grants unauthorized access to restricted plugin functions.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant threat to organizational security. Successful exploitation could lead to full unauthorized access, potential data exfiltration, or complete administrative takeover of the WordPress instance, resulting in severe reputational damage and service disruption.

Remediation Plan

Immediate Action: Update the Super Socializer plugin to a version beyond 7.14.5 immediately. If an update is not available, deactivate and remove the plugin until a secure version is released.

Proactive Monitoring: Review WordPress access logs for unusual administrative activity or successful logins originating from unknown or suspicious IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common authentication bypass patterns targeting WordPress plugins.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature, which lowers the barrier for entry for malicious actors.

Analyst Recommendation

Given the high severity of this vulnerability, administrators must prioritize patching. Failure to address this flaw leaves the application exposed to trivial exploitation, and immediate action is required to maintain the integrity and security of the host environment.

---METADATA---
VENDOR: PersianScript
PRODUCT: Persian Woocommerce SMS
AFFECTED_VERSIONS: n/a through 7.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the Persian Woocommerce SMS plugin allows authenticated shop managers to execute arbitrary SQL commands via improper neutralization of user-supplied input.

Executive Summary:
A SQL injection vulnerability in the Persian Woocommerce SMS plugin allows authenticated shop managers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2026-65532

Affected Software: PersianScript Persian Woocommerce SMS

Affected Versions: n/a through 7.2.2

Vulnerability: This is a CWE-89 SQL injection vulnerability occurring within the plugin. The flaw requires the attacker to hold shop manager privileges to successfully inject and execute malicious SQL queries.

Business Impact

Successful exploitation allows an attacker to manipulate the underlying database, potentially leading to unauthorized data exposure or modification. With a CVSS score of 7.6, the vulnerability represents a high risk to business operations, as it grants authenticated users excessive control over the application backend.

Remediation Plan

Immediate Action: Update the Persian Woocommerce SMS plugin to the latest version available from the vendor repository to incorporate the necessary security fixes.

Proactive Monitoring: Review database access logs for unusual query patterns or syntax errors that may indicate injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically configured to detect and block common SQL injection payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently exploitable by users with administrative-level access, making it a priority for environments where internal user trust is limited.

Analyst Recommendation

Given the high severity of this SQL injection flaw, administrators should prioritize updating the plugin immediately. Restricting administrative access to only trusted personnel will further reduce the risk of exploitation while the update process is managed.

---METADATA---
VENDOR: Themeisle
PRODUCT: Visualizer
AFFECTED_VERSIONS: n/a through 4.0.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Visualizer plugin for WordPress contains an SQL injection vulnerability that allows authenticated contributors to execute arbitrary database queries.

Executive Summary:
A high severity SQL injection vulnerability in the Visualizer plugin allows authenticated contributors to threaten database integrity.

Vulnerability Details

CVE-ID: CVE-2026-65526

Affected Software: Themeisle Visualizer

Affected Versions: n/a through 4.0.6

Vulnerability: This vulnerability is classified as a SQL injection issue where improper sanitization of user-supplied data allows for malicious SQL command execution. It is exploitable by authenticated users with contributor roles.

Business Impact

The ability to inject SQL commands can lead to unauthorized access to application data, including sensitive configuration or user information. The CVSS score of 8.5 underscores the need for immediate attention to prevent unauthorized database manipulation.

Remediation Plan

Immediate Action: Since no specific patch version is explicitly provided in the data, verify the status of the plugin and restrict contributor access until a vendor-supplied security update is confirmed and applied.

Proactive Monitoring: Review web server and database logs for anomalous activity originating from contributor-level sessions.

Compensating Controls: Implement Web Application Firewall rules to block SQL injection attempts, providing a layer of defense while awaiting an official software update.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically trivial to execute once a contributor account is compromised or utilized.

Analyst Recommendation

Administrators should monitor the vendor advisory page for a forthcoming patch and apply it immediately upon release. In the interim, limiting access to the plugin settings for non-administrative users is a recommended defensive practice.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab EE
AFFECTED_VERSIONS: GitLab EE: all versions from 15.5 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2
---END_METADATA---

Description Summary:
An improper authorization flaw in Group SAML identity management allows authenticated group owners to perform account takeovers of other group members.

Executive Summary:
A critical authorization vulnerability in GitLab EE has been observed in the wild, allowing authenticated group owners to compromise the accounts of other group members.

Vulnerability Details

CVE-ID: CVE-2026-6552

Affected Software: GitLab, GitLab EE

Affected Versions: GitLab EE: all versions from 15.5 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2

Vulnerability: The vulnerability stems from an improper authorization flaw within the Group SAML identity management functionality. It allows an authenticated user with a group Owner role to manipulate identity associations, enabling the takeover of another group member's account.

Business Impact

With a CVSS score of 8.7, this flaw poses a severe risk to organizational identity and access management. Because this vulnerability has been confirmed as exploited in the wild, the threat to business continuity and data integrity is immediate, potentially allowing attackers to bypass standard authentication controls and gain unauthorized access to proprietary intellectual property.

Remediation Plan

Immediate Action: Patch all affected GitLab EE installations to version 19.0.2, 18.11.5, or 18.10.8 immediately.

Proactive Monitoring: Monitor SAML authentication logs and group membership changes for suspicious modifications or unauthorized identity linking activities.

Compensating Controls: Restrict "Owner" role permissions to a minimal set of trusted administrators until the patch is successfully applied to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, this vulnerability has been exploited in the wild. Given the confirmed active exploitation, this must be treated as a high-priority security incident.

Analyst Recommendation

This vulnerability represents an active and critical threat to your environment. Administrators should verify if any unauthorized SAML identity modifications have occurred in their audit logs and apply the recommended security updates without delay to prevent further exploitation.

---METADATA---
VENDOR: Sergey
PRODUCT: AIWU
AFFECTED_VERSIONS: n/a through 1.5.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The AIWU plugin for WordPress is susceptible to an unauthenticated privilege escalation vulnerability due to incorrect privilege assignment.

Executive Summary:
This critical privilege escalation vulnerability in the AIWU WordPress plugin enables unauthenticated attackers to gain unauthorized administrative access to the host application.

Vulnerability Details

CVE-ID: CVE-2026-65507

Affected Software: Sergey AIWU

Affected Versions: n/a through 1.5.6

Vulnerability: The software suffers from a CWE-266 Incorrect Privilege Assignment flaw, which permits unauthenticated remote attackers to elevate their access levels. This bypasses standard user authentication and authorization mechanisms.

Business Impact

Exploitation allows attackers to gain full administrative control, which may result in unauthorized data access, modification of site content, or the injection of malicious scripts. The CVSS score of 9.8 underscores the extreme risk of total system compromise posed by this vulnerability.

Remediation Plan

Immediate Action: Update the AIWU WordPress plugin to version 1.5.8 or later as recommended by the vendor.

Proactive Monitoring: Audit the WordPress user database for suspicious accounts with administrative roles and monitor web server access logs for anomalous activity.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out malicious requests that attempt to exploit privilege assignment flaws in the plugin.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this an attractive target for automated exploitation tools.

Analyst Recommendation

The high severity of this vulnerability necessitates prompt remediation across all affected environments. Administrators should apply the specified update immediately to secure the application against potential unauthorized administrative access.

---METADATA---
VENDOR: Avada Studio
PRODUCT: Avada Core
AFFECTED_VERSIONS: 5.15.6 and prior
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Avada Core versions 5.15.6 and below are vulnerable to an unauthenticated Cross-Site Request Forgery (CSRF) attack, potentially leading to unauthorized administrative actions.

Executive Summary:
A critical CSRF vulnerability in Avada Core allows unauthenticated attackers to perform unauthorized actions on behalf of legitimate users.

Vulnerability Details

CVE-ID: CVE-2026-65471

Affected Software: Avada Studio Avada Core

Affected Versions: 5.15.6 and prior

Vulnerability: The plugin suffers from CWE-352, Cross-Site Request Forgery. Because the application lacks sufficient anti-CSRF tokens for critical functions, an unauthenticated attacker can trick a logged-in administrator into executing unintended, malicious actions.

Business Impact

The CVSS score of 9.6 reflects the high potential for system compromise. An attacker could force an administrator to create new user accounts, change site configurations, or inject malicious scripts, leading to a total loss of site integrity and potential data breach.

Remediation Plan

Immediate Action: Update the Avada Core plugin to version 5.15.7 or the latest available version to implement necessary CSRF protection.

Proactive Monitoring: Monitor site activity logs for unauthorized administrative changes or unexpected user account creation events.

Compensating Controls: Ensure that administrative sessions are kept short and implement strict IP-based access controls for the WordPress dashboard where possible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While CSRF typically requires user interaction, the high impact of the affected functions makes this a significant risk.

Analyst Recommendation

Administrators should treat this vulnerability with high urgency. Updating to version 5.15.7 is the only reliable method to resolve the underlying lack of CSRF protection. Please verify that all administrative sessions are terminated after applying the patch.

---METADATA---
VENDOR: Uncanny Owl
PRODUCT: Uncanny Automator
AFFECTED_VERSIONS: Up to and including 7.3.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Uncanny Automator WordPress plugin contains a SQL injection vulnerability that allows an authenticated administrator to manipulate database queries.

Executive Summary:
An authenticated SQL injection vulnerability in the Uncanny Automator WordPress plugin requires immediate attention to prevent unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2026-65462

Affected Software: Uncanny Owl Uncanny Automator

Affected Versions: Up to and including 7.3.2

Vulnerability: This is an SQL injection vulnerability (CWE-89) that allows an authenticated user with administrative privileges to execute arbitrary SQL commands. The flaw exists due to improper neutralization of special elements in database queries.

Business Impact

Successful exploitation could allow an administrative user to read, modify, or delete sensitive data stored in the WordPress database. While the CVSS score of 7.6 reflects a high severity, it is important to note that exploitation requires existing administrative access to the platform.

Remediation Plan

Immediate Action: Update the Uncanny Automator plugin to version 7.4.0 or the latest available release immediately.

Proactive Monitoring: Review database query logs for unusual or unauthorized SQL statements that deviate from normal plugin operation.

Compensating Controls: Ensure that database user permissions follow the principle of least privilege to limit the potential scope of an SQL injection attack.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is restricted to users who have already achieved administrative-level access, which serves as a significant barrier for external attackers.

Analyst Recommendation

Organizations using the Uncanny Automator plugin should verify their current version and upgrade to 7.4.0 as a priority. Maintaining updated plugins is critical to protecting the WordPress environment from elevated privilege attacks.

---METADATA---
VENDOR: ExpressTech
PRODUCT: Quiz And Survey Master
AFFECTED_VERSIONS: n/a through 11.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Quiz And Survey Master plugin for WordPress is susceptible to an SQL injection vulnerability, enabling authenticated contributors to perform unauthorized database operations.

Executive Summary:
A high severity SQL injection vulnerability in the Quiz And Survey Master plugin allows authenticated contributors to compromise database security.

Vulnerability Details

CVE-ID: CVE-2026-65454

Affected Software: ExpressTech Systems Quiz And Survey Master

Affected Versions: n/a through 11.2.0

Vulnerability: This is a SQL injection vulnerability resulting from improper input sanitization. The issue is accessible to users with contributor-level privileges or higher.

Business Impact

Exploitation of this vulnerability enables attackers to bypass intended database access restrictions, risking the exposure of sensitive user or survey data. The CVSS score of 8.5 reflects the high potential for impact on data integrity and confidentiality.

Remediation Plan

Immediate Action: Update the Quiz And Survey Master plugin to version 11.2.1 or later as the primary mitigation step.

Proactive Monitoring: Monitor database query performance and logs for suspicious SQL syntax or signs of unauthorized table access.

Compensating Controls: Utilize a Web Application Firewall to filter and sanitize incoming requests for potential SQL injection strings.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is reachable via standard plugin functionality by authenticated contributors.

Analyst Recommendation

Security teams should treat this vulnerability with high urgency. Applying the vendor-provided update is necessary to prevent potential data breaches facilitated by this SQL injection flaw.

---METADATA---
VENDOR: RomanCode
PRODUCT: MapSVG
AFFECTED_VERSIONS: n/a through 8.14.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The MapSVG plugin for WordPress contains an SQL injection vulnerability that allows authenticated contributors to execute malicious database queries.

Executive Summary:
A high severity SQL injection vulnerability in the MapSVG plugin allows authenticated contributors to compromise backend database integrity.

Vulnerability Details

CVE-ID: CVE-2026-65451

Affected Software: RomanCode MapSVG

Affected Versions: n/a through 8.14.0

Vulnerability: This vulnerability is a SQL injection flaw stemming from improper neutralization of special elements used in SQL commands. The attack requires the attacker to have at least contributor-level authentication to trigger the malicious query.

Business Impact

Successful exploitation allows an attacker to extract sensitive data or manipulate database contents, potentially leading to unauthorized data disclosure. With a CVSS score of 8.5, this high severity vulnerability poses a significant risk to the confidentiality and integrity of the WordPress application environment.

Remediation Plan

Immediate Action: Update the WordPress MapSVG plugin to version 8.14.1 or higher immediately.

Proactive Monitoring: Review database audit logs for unusual query patterns or unauthorized access attempts from contributor-level accounts.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block common SQL injection patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any user with contributor permissions.

Analyst Recommendation

Given the high CVSS score and the potential for database compromise, administrators must prioritize updating the MapSVG plugin. Patching to the latest version is the only definitive method to eliminate this SQL injection vector.

---METADATA---
VENDOR: RomanCode
PRODUCT: MapSVG
AFFECTED_VERSIONS: n/a through 8.14.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The MapSVG plugin for WordPress contains a SQL injection vulnerability that allows authenticated contributors to execute arbitrary database queries.

Executive Summary:
An authenticated SQL injection vulnerability in the MapSVG plugin exposes site databases to unauthorized query execution by contributors.

Vulnerability Details

CVE-ID: CVE-2026-65450

Affected Software: RomanCode MapSVG

Affected Versions: n/a through 8.14.0

Vulnerability: This vulnerability is a SQL injection flaw, CWE-89, occurring because the plugin fails to properly validate input during database operations. The vulnerability is accessible to authenticated users with contributor roles.

Business Impact

Successful exploitation could result in unauthorized access to sensitive database information, potentially compromising user data and site configuration. With a CVSS score of 8.5, this high severity flaw warrants immediate attention to prevent potential data breaches or unauthorized administrative actions.

Remediation Plan

Immediate Action: Update the MapSVG plugin to version 8.14.1 or later immediately to resolve the vulnerability.

Proactive Monitoring: Review security logs for anomalous database activity and monitor for any suspicious queries linked to contributor-level user accounts.

Compensating Controls: Implement a Web Application Firewall to filter out malicious SQL injection attempts until the update can be fully deployed.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for unconstrained database interaction by authenticated users.

Analyst Recommendation

This vulnerability presents a high risk to the integrity and confidentiality of the WordPress environment. Administrators must move quickly to update the MapSVG plugin to version 8.14.1 to neutralize the threat posed by this SQL injection flaw.

---METADATA---
VENDOR: Subtle Web Inc
PRODUCT: FormCraft
AFFECTED_VERSIONS: n/a through 3.9.15
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server Side Request Forgery (SSRF) vulnerability exists in the FormCraft plugin for WordPress, allowing unauthenticated attackers to perform unauthorized requests.

Executive Summary:
The FormCraft plugin for WordPress is vulnerable to unauthenticated Server Side Request Forgery, which could allow attackers to perform unauthorized requests from the server environment.

Vulnerability Details

CVE-ID: CVE-2026-65442

Affected Software: Subtle Web Inc FormCraft

Affected Versions: n/a through 3.9.15

Vulnerability: The vulnerability is a Server-Side Request Forgery (CWE-918) that occurs within the plugin, allowing unauthenticated attackers to send arbitrary requests to internal or external resources.

Business Impact

Successful exploitation of this SSRF vulnerability could allow an attacker to bypass network access controls, access internal metadata services, or interact with services behind the firewall. Given the CVSS score of 7.2, this is classified as a high-severity risk that could lead to unauthorized information disclosure or further network penetration.

Remediation Plan

Immediate Action: Update the WordPress FormCraft plugin to version 3.9.16 or later immediately to resolve the SSRF flaw.

Proactive Monitoring: Monitor server access logs for anomalous outbound requests originating from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious inbound requests targeting plugin-specific paths that may be involved in the SSRF vector.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it allows an unauthenticated actor to leverage the server as a proxy for malicious activity.

Analyst Recommendation

The presence of an unauthenticated SSRF vulnerability in a widely used plugin poses a significant security risk to the integrity of the hosting environment. Administrators should verify their current plugin version and apply the patch to 3.9.16 without delay to mitigate potential unauthorized access to internal network resources.

---METADATA---
VENDOR: Regular Labs
PRODUCT: GeoIP extension for Joomla
AFFECTED_VERSIONS: 1.0.0-6.3.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in the Regular Labs GeoIP extension for Joomla allows for arbitrary file writes during the extraction of database update archives.

Executive Summary:
A critical path traversal vulnerability in the Regular Labs GeoIP extension for Joomla could allow an unauthenticated attacker to overwrite arbitrary files on the host filesystem.

Vulnerability Details

CVE-ID: CVE-2026-65431

Affected Software: Regular Labs GeoIP extension for Joomla

Affected Versions: 1.0.0-6.3.8

Vulnerability: This is a path traversal vulnerability (CWE-22), commonly known as Zip Slip, where the extension fails to validate paths within Geo IP database update archives. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation enables unauthorized file system access, which may lead to remote code execution, system compromise, or complete service disruption. The ability to overwrite arbitrary files poses a significant risk to the integrity and availability of the Joomla installation and the underlying server.

Remediation Plan

Immediate Action: Update the Regular Labs GeoIP extension for Joomla to the latest available version released after July 22, 2026.

Proactive Monitoring: Review web server and application logs for suspicious file extraction patterns or requests directed at unexpected directories.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the nature of Zip Slip vulnerabilities, which grant attackers broad control over the filesystem.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for full system compromise, administrators should prioritize updating the GeoIP extension immediately. Ensure that the integrity of the Joomla installation is verified following any updates to confirm no malicious files were introduced prior to remediation.

---METADATA---
VENDOR: Regular Labs
PRODUCT: GeoIP extension for Joomla
AFFECTED_VERSIONS: regularlabs.com GeoIP extension for Joomla: 1.0.0-6.3.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Regular Labs GeoIP extension for Joomla leaks sensitive MaxMind credentials in request URLs, exposing them to unauthorized parties.

Executive Summary:
A credential leakage vulnerability in the Regular Labs GeoIP extension for Joomla allows unauthorized access to MaxMind services via exposed request parameters.

Vulnerability Details

CVE-ID: CVE-2026-65430

Affected Software: Regular Labs GeoIP extension for Joomla

Affected Versions: regularlabs.com GeoIP extension for Joomla: 1.0.0-6.3.8

Vulnerability: This is a sensitive information exposure vulnerability where MaxMind credentials are transmitted in request URLs. This data can be captured by logs, proxies, or browser history, allowing attackers to hijack the service account.

Business Impact

With a CVSS score of 7.5, this vulnerability enables unauthorized consumption of paid GeoIP services. This can result in significant financial loss through quota exhaustion and potential exposure of sensitive geolocation data associated with the victim's account.

Remediation Plan

Immediate Action: Update to the latest version of the Regular Labs GeoIP extension for Joomla, such as 7.0.3 or later.

Proactive Monitoring: Audit web server logs and proxy logs for the presence of sensitive credential information in request URLs.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests that contain patterns matching leaked credential formats.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable if an attacker has visibility into the target's network traffic or log files.

Analyst Recommendation

Users of the GeoIP extension must update to the latest patched version immediately. Following the update, consider rotating any MaxMind credentials that may have been exposed in logs or history.

---METADATA---
VENDOR: o6 Automation
PRODUCT: open62541
AFFECTED_VERSIONS: 1.3.0 through 1.3.17, 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, master
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An integer overflow in the open62541 UA_Variant arrayDimensions computation allows a remote attacker to trigger an out of bounds write.

Executive Summary:
A critical integer overflow vulnerability in open62541 can lead to memory corruption, posing a significant risk of remote code execution or system instability.

Vulnerability Details

CVE-ID: CVE-2026-65423

Affected Software: o6 Automation open62541

Affected Versions: 1.3.0 through 1.3.17, 1.4.0 through 1.4.16, 1.5.0 through 1.5.4, and master branch.

Vulnerability: This vulnerability is an integer overflow (CWE-190) occurring within the UA_Variant arrayDimensions computation. It requires low privileges to execute and allows a remote attacker to perform an out of bounds write, which could be leveraged to compromise the host system.

Business Impact

The CVSS score of 8.8 reflects the high severity of this flaw, as it allows for significant impact to confidentiality, integrity, and availability. Successful exploitation may result in unauthorized system access, data loss, or the complete compromise of devices running the affected automation software, potentially disrupting critical industrial operations.

Remediation Plan

Immediate Action: Users should update to the latest version of open62541 by contacting o6 Automation directly or pulling the latest source code fixes provided in the referenced GitHub commits.

Proactive Monitoring: Monitor device logs for unusual crash patterns or unexpected memory allocation errors that may indicate exploitation attempts.

Compensating Controls: Implement network segmentation to restrict access to the affected automation services and ensure they are not exposed to untrusted networks.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 31, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. The flaw is technically complex, requiring specific manipulation of array dimensions to trigger the overflow.

Analyst Recommendation

Given the high CVSS score and the critical nature of industrial automation software, organizations should prioritize patching these systems during the next maintenance window. Apply the provided vendor source code fixes immediately to remediate the underlying memory corruption risk.

---METADATA---
VENDOR: Apple
PRODUCT: macOS
AFFECTED_VERSIONS: macOS: 0 up to (excluding) 14.8.9, 0 up to (excluding) 15.7.9, 0 up to (excluding) 26.6.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper authentication flaw in Apple macOS Screen Sharing allows unauthenticated network attackers to bypass credentials and gain remote access.

Executive Summary:
A critical authentication bypass in Apple macOS Screen Sharing is currently being exploited in the wild by remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-65400

Affected Software: Apple macOS

Affected Versions: macOS versions prior to 14.8.9, 15.7.9, and 26.6.1.

Vulnerability: The vulnerability exists within the Screen Sharing component, where an attacker on the network can authenticate without providing valid credentials (CWE-287). This flaw is remotely exploitable without requiring user interaction.

Business Impact

With a CVSS score of 9.5, this vulnerability presents a high risk of unauthorized remote control over affected macOS devices. Successful exploitation could lead to full system compromise, the theft of sensitive local files, and the potential for lateral movement within the network.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Apple to update macOS to the specified patched versions.

Proactive Monitoring: Review system logs for unauthorized Screen Sharing sessions and monitor network traffic for connections attempting to bypass standard authentication protocols.

Compensating Controls: Disable Screen Sharing services if they are not required for business operations, and restrict access to these services via local firewall rules to trusted networks only.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of August 18, 2026. The flaw's ability to allow unauthenticated access to Screen Sharing makes it an attractive target for remote attackers.

Analyst Recommendation

This is a critical security issue that requires immediate attention due to confirmed active exploitation. Administrators should ensure all macOS endpoints are updated to the secure versions without delay to prevent unauthorized remote access.

---METADATA---
VENDOR: Tigera
PRODUCT: Calico
AFFECTED_VERSIONS: Tigera Calico: 0 up to (excluding) 3.31.6; Tigera Calico Enterprise: 0 up to (excluding) 3.21.7, 3.22.0 up to (excluding) 3.22.4; Tigera Calico Cloud: 0 up to (excluding) 22.4.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Tigera Calico fails to perform URL path normalization in its Application Layer Policy, potentially allowing attackers to bypass security rules.

Executive Summary:
A path traversal vulnerability in Tigera Calico's Application Layer Policy may allow unauthenticated attackers to bypass intended network security restrictions.

Vulnerability Details

CVE-ID: CVE-2026-6540

Affected Software: Tigera Calico

Affected Versions: Tigera Calico: 0 up to (excluding) 3.31.6; Tigera Calico Enterprise: 0 up to (excluding) 3.21.7, 3.22.0 up to (excluding) 3.22.4; Tigera Calico Cloud: 0 up to (excluding) 22.4.0

Vulnerability: This is a path traversal vulnerability (CWE-22, CWE-23) occurring within the Dikastes component. The lack of URL path normalization allows an unauthenticated attacker to craft malicious requests that may circumvent HTTP-based security policies.

Business Impact

Successful exploitation allows an attacker to bypass granular access controls defined in Application Layer Policies. This could lead to unauthorized access to restricted internal resources, potentially resulting in data exposure or the compromise of sensitive backend services. Given the CVSS score of 7.9, this vulnerability presents a high risk to the confidentiality and integrity of containerized environments.

Remediation Plan

Immediate Action: Upgrade to the patched versions specified in the vendor advisory (Calico 3.31.6, Calico Enterprise 3.21.7 or 3.22.4, or Calico Cloud 22.4.0).

Proactive Monitoring: Monitor network and application logs for unusual request patterns, particularly those containing encoded characters or directory traversal sequences aimed at sensitive endpoints.

Compensating Controls: Ensure that strict input validation and path normalization are implemented at the ingress controller level to provide defense-in-depth while patches are applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it undermines the fundamental security policy enforcement mechanism of the Calico service mesh.

Analyst Recommendation

Organizations utilizing Tigera Calico should prioritize patching immediately to prevent potential security policy bypasses. Failure to address this flaw could allow attackers to traverse network boundaries, necessitating an urgent update cycle for all affected deployments.

---METADATA---
VENDOR: laughingman7743
PRODUCT: PyAthena
AFFECTED_VERSIONS: 0 through 3.35.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An SQL injection vulnerability in PyAthena versions prior to 3.35.4 allows unauthenticated attackers to execute arbitrary SQL commands due to improper quote-escaping in the DefaultParameterFormatter.

Executive Summary:
A critical SQL injection flaw in the PyAthena library enables remote, unauthenticated attackers to exfiltrate data or execute unauthorized database commands.

Vulnerability Details

CVE-ID: CVE-2026-65321

Affected Software: laughingman7743 PyAthena

Affected Versions: 0 through 3.35.3

Vulnerability: The vulnerability exists in the DefaultParameterFormatter.format() function, which incorrectly escapes single quotes using backslashes. Because the underlying engines (Athena and Trino) do not recognize backslashes as escape characters, attackers can inject malicious SQL syntax to perform unauthorized operations.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its potential for severe impact. Successful exploitation could lead to the total compromise of database confidentiality and integrity, including large-scale data exfiltration, the execution of destructive SQL statements, and unauthorized control over database operations.

Remediation Plan

Immediate Action: Upgrade the PyAthena library to version 3.35.4 or later to implement the correct quote-escaping logic.

Proactive Monitoring: Audit database logs for unusual query patterns, particularly those involving unexpected UNION SELECT statements or modifications to CTAS destinations.

Compensating Controls: Implement strict input validation at the application layer to sanitize all user-supplied data before it is passed to the PyAthena library.

Exploitation Status

Public Exploit Available: No confirmed public weaponized exploit exists in the available data.

Analyst Notes: As of August 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on specific parser behaviors in Athena and Trino may limit the ease of exploitation, but the severity remains high due to the potential for unauthenticated access.

Analyst Recommendation

Given the ease with which SQL injection can be automated and the critical nature of the impact, organizations should immediately update PyAthena to the patched version. Applications relying on this library for database interactions should be reviewed to ensure they are not exposing sensitive database interfaces to untrusted user input.

---METADATA---
VENDOR: ANDRITZ
PRODUCT: HIPASE-250
AFFECTED_VERSIONS: 0 through 7.20
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A provisioning script in the ANDRITZ HIPASE-250 and 250 SCALA engineering workstations sets a hard-coded x11vnc password, allowing unauthorized remote access.

Executive Summary:
Hard-coded credentials in ANDRITZ HIPASE-250 engineering workstations create a critical security vulnerability that allows unauthorized remote access to the system.

Vulnerability Details

CVE-ID: CVE-2026-65313

Affected Software: ANDRITZ HIPASE-250 and 250 SCALA

Affected Versions: 0 through 7.20

Vulnerability: The vulnerability stems from the use of a hard-coded password for the x11vnc service, which is established during the provisioning of engineering workstations. This is an authentication-related flaw that allows attackers with local network access to gain unauthorized control.

Business Impact

With a CVSS score of 8.1, this vulnerability poses a severe risk to operational technology environments. Unauthorized access to an engineering workstation can lead to the manipulation of industrial processes, loss of system control, or the compromise of sensitive operational data.

Remediation Plan

Immediate Action: Update to version 8.15 or later, which contains the fix for the hard-coded credential issue.

Proactive Monitoring: Audit network access logs for the x11vnc service and restrict access to these workstations to authorized personnel only.

Compensating Controls: Disable the x11vnc service if it is not required for daily operations, or implement strong network segmentation to isolate the engineering workstations from untrusted segments.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on hard-coded credentials represents a significant failure in secure deployment practices.

Analyst Recommendation

This vulnerability requires immediate attention due to the ease of exploitation once an attacker has network access. Organizations should perform an inventory of all affected workstations and ensure the upgrade to version 8.15 is executed as part of a formal maintenance window.

---METADATA---
VENDOR: ANDRITZ
PRODUCT: HIPASE-250
AFFECTED_VERSIONS: 0 through 7.20
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ANDRITZ HIPASE-250 exposes its configuration endpoint without authentication, allowing unauthenticated remote access and permissive cross-domain policies.

Executive Summary:
The ANDRITZ HIPASE-250 device is vulnerable to unauthorized remote configuration access due to missing authentication and permissive CORS policies.

Vulnerability Details

CVE-ID: CVE-2026-65310

Affected Software: ANDRITZ HIPASE-250, 250 SCALA

Affected Versions: 0 through 7.20

Vulnerability: The system suffers from missing authentication for critical functions (CWE-306) and a permissive cross-domain security policy (CWE-942). These flaws allow an unauthenticated remote attacker to interact with the device configuration endpoint via cross-origin requests.

Business Impact

The CVSS score of 7.5 reflects the high risk of unauthorized control over industrial infrastructure components. Exploitation could allow an attacker to modify device configurations, potentially leading to operational disruption or complete loss of control over the affected hardware.

Remediation Plan

Immediate Action: Update the HIPASE-250 or 250 SCALA firmware to version 7.40 or higher immediately.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts directed at device configuration endpoints and check for suspicious cross-origin requests.

Compensating Controls: Isolate the management interface of the device behind a secure VPN or dedicated management network to prevent direct internet exposure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of this flaw implies that any device exposed to the network is at risk of unauthorized administrative access.

Analyst Recommendation

Given the industrial control nature of the affected product, this vulnerability poses a severe operational risk. It is imperative to isolate the devices from untrusted networks and apply the firmware update as soon as possible to enforce authentication and secure cross-domain policies.

---METADATA---
VENDOR: ANDRITZ
PRODUCT: HIPASE-250
AFFECTED_VERSIONS: ANDRITZ HIPASE-250: 0 through 7.20, ANDRITZ 250 SCALA: 0 through 7.20
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ANDRITZ HIPASE-250 and 250 SCALA store and transmit user passwords in a reversible format instead of utilizing secure one-way hashing.

Executive Summary:
The ANDRITZ HIPASE-250 system is vulnerable to credential exposure due to the use of reversible password storage, creating a significant risk of unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-65309

Affected Software: ANDRITZ HIPASE-250 and 250 SCALA

Affected Versions: 0 through 7.20

Vulnerability: This vulnerability involves the use of weak cryptographic practices, specifically storing and transmitting passwords in a reversible format. The attack vector is network-based and requires no authentication, allowing an unauthenticated remote attacker to potentially recover sensitive credentials.

Business Impact

The use of reversible password storage directly facilitates unauthorized access to the HIPASE-250 platform. Given the CVSS score of 7.5, this high-severity flaw could lead to complete compromise of sensitive user accounts, resulting in unauthorized control over industrial systems, potential data exfiltration, and severe operational disruption.

Remediation Plan

Immediate Action: Update all instances of HIPASE-250 and 250 SCALA to version 7.50 or later to implement secure password hashing.

Proactive Monitoring: Review system access logs for anomalous login patterns or unauthorized authentication attempts that may indicate credential harvesting.

Compensating Controls: Restrict network access to the management interface via VPN or VLAN isolation to minimize exposure to unauthenticated external actors while the update is pending.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows for the trivial recovery of plaintext passwords once an attacker gains access to the credential store or captures network traffic.

Analyst Recommendation

This vulnerability represents a critical failure in credential protection that necessitates immediate attention. Administrators must prioritize updating to version 7.50, as the current method of password storage provides no effective defense against credential recovery. Failure to patch will leave the system permanently exposed to unauthorized access, jeopardizing the integrity of the entire environment.

---METADATA---
VENDOR: Zohocorp
PRODUCT: ManageEngine ADAudit Plus
AFFECTED_VERSIONS: 0 up to (excluding) 8606
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ManageEngine ADAudit Plus is vulnerable to unauthenticated remote code execution due to a flaw in the agent API, which fails to properly neutralize OS commands.

Executive Summary:
A critical unauthenticated remote code execution vulnerability in ManageEngine ADAudit Plus enables attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-6516

Affected Software: Zohocorp ManageEngine ADAudit Plus

Affected Versions: 0 up to (excluding) 8606

Vulnerability: The vulnerability is categorized as an OS command injection flaw located within the agent API. It allows unauthenticated attackers to send specially crafted requests that result in the execution of arbitrary commands on the host server.

Business Impact

A successful exploit provides the attacker with full control over the server hosting ADAudit Plus. Because ADAudit Plus typically operates with elevated privileges to monitor Active Directory environments, this compromise could lead to lateral movement within the network, theft of sensitive credentials, and complete domain compromise. The CVSS score of 10.0 highlights the maximum severity of this vulnerability.

Remediation Plan

Immediate Action: Update ManageEngine ADAudit Plus to build 8606 or higher immediately.

Proactive Monitoring: Monitor server logs for suspicious child processes or unauthorized shell executions originating from the ADAudit Plus service account.

Compensating Controls: Use a network firewall to restrict access to the ADAudit Plus management interface and agent API to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Command injection flaws in management software are frequently targeted by attackers due to the high level of trust and privilege these applications hold in an enterprise environment.

Analyst Recommendation

This is a critical vulnerability that requires immediate remediation. All instances of ManageEngine ADAudit Plus must be updated to the latest version to prevent potential remote code execution. Security teams should prioritize this update as part of their urgent patch management lifecycle.

---METADATA---
VENDOR: InfusedWoo
PRODUCT: InfusedWoo Pro Plugin for WordPress
AFFECTED_VERSIONS: Up to and including 5.1.2
---END_METADATA---

Description Summary:
The InfusedWoo Pro plugin for WordPress is vulnerable to an authorization bypass that allows unauthenticated attackers to perform destructive actions on site content.

Executive Summary:
An authorization bypass flaw in the InfusedWoo Pro plugin for WordPress enables unauthenticated attackers to delete posts, pages, and orders, or modify site status.

Vulnerability Details

CVE-ID: CVE-2026-6512

Affected Software: InfusedWoo, InfusedWoo Pro Plugin for WordPress

Affected Versions: Up to and including 5.1.2

Vulnerability: The plugin fails to perform adequate authorization checks on critical administrative functions. This allows unauthenticated attackers to trigger destructive actions, including mass-deletion of comments and modification of post statuses.

Business Impact

This vulnerability carries a CVSS score of 9.1, reflecting its potential for severe operational disruption. Successful exploitation could lead to significant data loss, destruction of e-commerce records, and long-term reputational damage to the affected business entity.

Remediation Plan

Immediate Action: Update the InfusedWoo Pro plugin to the latest version immediately.

Proactive Monitoring: Regularly audit site content and database logs to identify unauthorized modifications or deletions of critical business records.

Compensating Controls: Restrict access to administrative endpoints via a WAF or IP-based allowlisting if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates prompt action to prevent potential site defacement or data destruction. All administrators should prioritize updating the InfusedWoo Pro plugin to the latest version to restore proper authorization controls.

---METADATA---
VENDOR: WordPress
PRODUCT: InfusedWoo Pro Plugin
AFFECTED_VERSIONS: Up to and including 5.1.2
---END_METADATA---

Description Summary:
The InfusedWoo Pro WordPress plugin is vulnerable to authentication bypass and privilege escalation via an insecure AJAX handler.

Executive Summary:
A critical privilege escalation vulnerability in the InfusedWoo Pro plugin allows unauthenticated attackers to gain administrative access via a crafted URL.

Vulnerability Details

CVE-ID: CVE-2026-6510

Affected Software: WordPress InfusedWoo Pro Plugin

Affected Versions: Up to and including 5.1.2

Vulnerability: The vulnerability stems from missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler. An unauthenticated attacker can create a malicious recipe that forces an auto-login action, enabling them to hijack any user account, including administrators.

Business Impact

The CVSS score of 9.8 underscores the severity of this risk. Successful exploitation allows unauthorized users to gain full administrative privileges, leading to complete compromise of the WordPress site, user database exfiltration, and unauthorized content modification.

Remediation Plan

Immediate Action: Update the InfusedWoo Pro plugin to the latest version immediately to ensure proper authorization checks are implemented.

Proactive Monitoring: Review user account creation logs and audit administrative activity for suspicious logins or unauthorized changes to site configurations.

Compensating Controls: Use a WAF to restrict access to AJAX endpoints and monitor for unusual request patterns targeting the plugin's configuration files.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability grants attackers full control with minimal effort. It is imperative that administrators update the plugin immediately and audit existing user accounts for any signs of unauthorized account creation or privilege changes.

---METADATA---
VENDOR: TUBITAK BILGEM
PRODUCT: Pardus Update
AFFECTED_VERSIONS: <=0.6.3 up to (excluding) 0.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in the Pardus Update utility allows local attackers to escalate privileges on the affected system.

Executive Summary:
A high-severity missing authorization flaw in Pardus Update enables local attackers to achieve unauthorized privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-6509

Affected Software: TUBITAK BILGEM Pardus Update

Affected Versions: <=0.6.3 up to (excluding) 0.6.6

Vulnerability: The application fails to properly validate user authorization (CWE-862) during update processes. This allows a local attacker with standard user privileges to execute actions that should be restricted to administrative accounts.

Business Impact

Successful exploitation of this vulnerability allows an attacker to elevate their access level, potentially gaining full control over the host operating system. Given the CVSS score of 7.8, the business impact includes the risk of unauthorized data access, system-wide configuration changes, and the installation of persistent malicious software.

Remediation Plan

Immediate Action: Upgrade the Pardus Update utility to version 0.6.6 or the latest version provided by the vendor.

Proactive Monitoring: Review system audit logs for anomalous account activity or unexpected execution of administrative commands by standard users.

Compensating Controls: Enforce strict the principle of least privilege by auditing user group memberships and limiting the ability of standard users to trigger system-level updates.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation vulnerabilities are critical as they provide a pathway for attackers to bypass security boundaries. Organizations should verify their current version of Pardus Update and apply the necessary patches immediately to prevent unauthorized administrative access.

---METADATA---
VENDOR: TUBITAK BILGEM Software Technologies Research Institute
PRODUCT: Liderahenk
AFFECTED_VERSIONS: 2.0.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Liderahenk contains an origin validation error that allows unauthenticated access to restricted application functionality by bypassing configured Access Control Lists (ACLs).

Executive Summary:
A critical origin validation error in Liderahenk allows unauthorized access to sensitive functionality, posing a severe risk of complete system compromise.

Vulnerability Details

CVE-ID: CVE-2026-6508

Affected Software: TUBITAK BILGEM Software Technologies Research Institute Liderahenk

Affected Versions: 2.0.1

Vulnerability: This vulnerability stems from a failure to properly validate the origin of requests, allowing an unauthenticated attacker to bypass established ACLs. This effectively grants access to administrative or restricted functions that should otherwise be protected.

Business Impact

The CVSS score of 9.8 indicates a critical risk to the confidentiality, integrity, and availability of the Liderahenk platform. Exploitation could allow an attacker to perform unauthorized administrative actions, leading to full system compromise and significant data breaches.

Remediation Plan

Immediate Action: Upgrade to Liderahenk version 2.0.2 or the latest vendor-supplied patch.

Proactive Monitoring: Monitor system logs for unauthorized access attempts to restricted API endpoints or administrative functions.

Compensating Controls: Restrict network access to the Liderahenk interface using IP allow-lists and ensure it is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a total failure of authorization controls. Organizations utilizing Liderahenk must treat this as a high-priority remediation item and apply the necessary updates immediately to secure their environment.

---METADATA---
VENDOR: Infused Addons
PRODUCT: InfusedWoo Pro
AFFECTED_VERSIONS: 0 through 5.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The InfusedWoo Pro plugin for WordPress contains a missing authorization vulnerability that allows authenticated users to escalate their privileges.

Executive Summary:
A missing authorization flaw in the InfusedWoo Pro plugin for WordPress enables authenticated attackers to perform unauthorized privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-6506

Affected Software: Infused Addons InfusedWoo Pro

Affected Versions: 0 through 5.1.2

Vulnerability: This is a Missing Authorization (CWE-862) vulnerability that occurs because the plugin fails to perform adequate capability checks, allowing an authenticated user to perform actions outside their assigned privilege level.

Business Impact

Successful exploitation allows an attacker to gain elevated administrative privileges, potentially leading to full site compromise, data loss, or the installation of malicious backdoors. The CVSS score of 8.8 (High) reflects the severity of allowing unauthorized privilege escalation within a web application environment.

Remediation Plan

Immediate Action: Update the InfusedWoo Pro plugin to version 5.1.3 or later immediately.

Proactive Monitoring: Audit WordPress user accounts for suspicious additions or modifications to administrative roles that occurred recently.

Compensating Controls: Disable the plugin immediately if an update cannot be applied and verify the site for any unauthorized administrative accounts created during the window of vulnerability.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a published weaponized exploit for this vulnerability. The flaw is inherently dangerous due to the potential for complete site takeover via privilege escalation.

Analyst Recommendation

Privilege escalation vulnerabilities are critical threats to any CMS-based infrastructure. Administrators must update the affected plugin immediately and conduct a thorough audit of all existing user accounts to ensure no unauthorized escalation has already taken place.

---METADATA---
VENDOR: n8n
PRODUCT: n8n
AFFECTED_VERSIONS: 0 up to 1.123.64, 2.30.1, 2.29.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The n8n workflow automation tool contains an authorization bypass vulnerability that allows authenticated users to escalate privileges via user-controlled keys.

Executive Summary:
An authorization bypass vulnerability in n8n allows authenticated users to escalate privileges, posing a risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-65016

Affected Software: n8n

Affected Versions: 0 up to 1.123.64, 2.30.1, and 2.29.8

Vulnerability: This vulnerability is an authorization bypass (CWE-639) triggered by user-controlled keys. The flaw permits an authenticated user to perform unauthorized actions or gain elevated privileges, effectively bypassing existing security controls within the n8n application.

Business Impact

The ability to bypass authorization mechanisms presents a critical risk to the integrity and confidentiality of the n8n instance. An attacker could gain unauthorized administrative control over workflows or sensitive data, leading to a total compromise of the application environment. The CVSS score of 7.7 reflects the high impact on data and service integrity.

Remediation Plan

Immediate Action: Update the n8n application to version 1.123.64, 2.30.1, or 2.29.8, depending on the specific branch in use.

Proactive Monitoring: Review application logs for unusual administrative activity or unauthorized access attempts associated with user sessions and SSO integration.

Compensating Controls: Restrict access to the n8n instance to trusted internal networks and utilize strong authentication methods to minimize the risk of compromised user credentials.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of this flaw makes it a primary target for attackers seeking to escalate privileges within workflow automation platforms.

Analyst Recommendation

Because this vulnerability allows for privilege escalation, it represents a significant threat to the security posture of the n8n deployment. Administrators must apply the provided updates immediately to ensure that authorization logic is correctly enforced and to prevent potential unauthorized access.