PatchTheCVE: gvectors

CVE-2026-22216: wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to

Wed, 17 Jun 2026 10:19:34 +0000

MEDIUM 6.5: wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard cha

CVE-2026-22215: wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function th

Wed, 17 Jun 2026 10:19:33 +0000

MEDIUM 4.3: wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by expl

CVE-2026-22210: wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious

Wed, 17 Jun 2026 10:19:33 +0000

MEDIUM 4.4: wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary Java

CVE-2026-22209: wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows admini

Wed, 17 Jun 2026 10:19:33 +0000

MEDIUM 5.5: wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking out of style tags. Attackers with admin access can inject payloads like in the custom CSS setting to execut

CVE-2026-22204: wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate ma

Wed, 17 Jun 2026 10:19:32 +0000

LOW 3.7: wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_email cookie. Attackers can craft a malicious cookie value that, when processed through urldecode() and passed to wp_mail()

CVE-2026-22203: wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvert

Wed, 17 Jun 2026 10:19:32 +0000

MEDIUM 4.9: wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret, a

CVE-2026-22202: wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all

Wed, 17 Jun 2026 10:19:32 +0000

HIGH 8.1: wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to tr

CVE-2026-22201: wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to

Wed, 17 Jun 2026 10:19:32 +0000

MEDIUM 5.3: wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR headers to spoof their IP address and circumven

CVE-2026-22199: Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upl

Wed, 17 Jun 2026 10:19:31 +0000

HIGH 7.5: Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the device filesystem by supplying directory traversal sequences in the params parameter. Attackers can expl

CVE-2026-22193: wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where str

Wed, 17 Jun 2026 10:19:31 +0000

HIGH 8.1: wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate

CVE-2026-22192: Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthent

Wed, 17 Jun 2026 10:19:31 +0000

CRITICAL 9.9: Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authentication state to bypass server-side access con

CVE-2026-22191: Beghelli Sicuro24 SicuroWeb contains a template injection vulnerability that allows attackers to inject arbitr

Wed, 17 Jun 2026 10:19:30 +0000

MEDIUM 5.2: Beghelli Sicuro24 SicuroWeb contains a template injection vulnerability that allows attackers to inject arbitrary AngularJS expressions by exploiting improper rendering of untrusted input in AngularJS template contexts. Attackers can inject malicious expressions that are compiled and executed by the

CVE-2026-22183: wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview func

Wed, 17 Jun 2026 10:19:29 +0000

MEDIUM 6.1: wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inject malicious scripts by submitting comments with unescaped content. Attackers with unfiltered_html capabilities can inject JavaScript directl

CVE-2026-22182: wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users

Wed, 17 Jun 2026 10:19:29 +0000

HIGH 7.5: wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and comment_id par

CVE-2026-28562: wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER

Wed, 17 Jun 2026 10:28:51 +0000

HIGH 8.2: wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentia

CVE-2026-28561: wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject

Wed, 17 Jun 2026 10:28:51 +0000

MEDIUM 5.5: wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or with a compromised admin account, attack

CVE-2026-28560: wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via foru

Wed, 17 Jun 2026 10:28:51 +0000

MEDIUM 5.5: wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break o

CVE-2026-28559: wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retr

Wed, 17 Jun 2026 10:28:51 +0000

MEDIUM 5.3: wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that ar

CVE-2026-28558: wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers