Skip to content

Commit 6f33003

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2rhh-26wh-jr9r GHSA-36vc-76hh-jxcp GHSA-8c83-cvgq-pp7w GHSA-8m92-8r47-wxqw GHSA-925f-q35m-63gx GHSA-9rg8-r3vc-rhj3 GHSA-cm5v-3h7v-m7cv GHSA-fq9v-x83p-g6p3 GHSA-hvcw-qp77-8m24 GHSA-jqhg-j5gv-hpmr GHSA-jxwf-hc6h-vhc7 GHSA-mfwc-76p3-m2rc GHSA-mhrq-g838-222j GHSA-p9m7-fwrr-649p GHSA-vm4c-6g35-79xf GHSA-xm8p-wgjh-pfxf
1 parent 36b0ddd commit 6f33003

16 files changed

Lines changed: 397 additions & 7 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-2rhh-26wh-jr9r/GHSA-2rhh-26wh-jr9r.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2rhh-26wh-jr9r",
4+
"modified": "2026-02-26T03:31:18Z",
5+
"published": "2026-02-26T03:31:18Z",
6+
"aliases": [
7+
"CVE-2026-2499"
8+
],
9+
"details": "The Custom Logo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2499"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/custom-logo/tags/2.2/custom-logo.php#L18"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/custom-logo/trunk/custom-logo.php#L18"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/92705581-9a0d-4d23-9118-fec9100e4ce1?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-26T02:16:25Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-36vc-76hh-jxcp/GHSA-36vc-76hh-jxcp.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-36vc-76hh-jxcp",
4-
"modified": "2026-02-20T00:31:53Z",
4+
"modified": "2026-02-26T03:31:17Z",
55
"published": "2026-02-20T00:31:53Z",
66
"aliases": [
77
"CVE-2026-1658"
88
],
99
"details": "User Interface (UI) Misrepresentation of Critical Information vulnerability in OpenText™ Directory Services allows Cache Poisoning. \n\nThe vulnerability could be exploited by a bad actor to inject manipulated text into the OpenText application, potentially misleading users.\n\nThis issue affects Directory Services: from 20.4.1 through 25.2.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:L/U:Clear"

‎advisories/unreviewed/2026/02/GHSA-8c83-cvgq-pp7w/GHSA-8c83-cvgq-pp7w.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8c83-cvgq-pp7w",
4-
"modified": "2026-02-24T21:31:47Z",
4+
"modified": "2026-02-26T03:31:17Z",
55
"published": "2026-02-24T21:31:47Z",
66
"aliases": [
77
"CVE-2026-24443"
88
],
99
"details": "EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not require validation of the current password before allowing a new password to be set. An attacker who gains temporary access to an authenticated user session can change the account password without knowledge of the original credentials. This enables persistent account takeover and, if administrative accounts are affected, may result in privilege escalation.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/02/GHSA-8m92-8r47-wxqw/GHSA-8m92-8r47-wxqw.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,8 @@
5050
],
5151
"database_specific": {
5252
"cwe_ids": [
53-
"CWE-285"
53+
"CWE-285",
54+
"CWE-639"
5455
],
5556
"severity": "MODERATE",
5657
"github_reviewed": false,

‎advisories/unreviewed/2026/02/GHSA-925f-q35m-63gx/GHSA-925f-q35m-63gx.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,8 @@
5858
],
5959
"database_specific": {
6060
"cwe_ids": [
61-
"CWE-119"
61+
"CWE-119",
62+
"CWE-125"
6263
],
6364
"severity": "MODERATE",
6465
"github_reviewed": false,

‎advisories/unreviewed/2026/02/GHSA-9rg8-r3vc-rhj3/GHSA-9rg8-r3vc-rhj3.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9rg8-r3vc-rhj3",
4+
"modified": "2026-02-26T03:31:18Z",
5+
"published": "2026-02-26T03:31:18Z",
6+
"aliases": [
7+
"CVE-2026-2029"
8+
],
9+
"details": "The Livemesh Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[labb_pricing_item]` shortcode's `title` and `value` attributes in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. Specifically, the plugin uses `htmlspecialchars_decode()` after `wp_kses_post()`, which decodes HTML entities back into executable code after sanitization has occurred. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2029"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/includes/modules/labb-pricing-table/labb-pricing-table.php#L51"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/includes/modules/labb-pricing-table/labb-pricing-table.php#L59"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8bc96b4f-256e-491b-9d27-de1adbf67643?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-26T02:16:24Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-cm5v-3h7v-m7cv/GHSA-cm5v-3h7v-m7cv.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cm5v-3h7v-m7cv",
4+
"modified": "2026-02-26T03:31:18Z",
5+
"published": "2026-02-26T03:31:18Z",
6+
"aliases": [
7+
"CVE-2026-2489"
8+
],
9+
"details": "The TP2WP Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Watched domains' textarea on the attachment importer settings page in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping when domains are saved via AJAX and rendered with echo implode() without esc_textarea(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the attachment importer settings page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2489"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/tp2wp-importer/tags/1.1/attachments/templates/page.php#L28"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/tp2wp-importer/trunk/attachments/templates/page.php#L28"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4eacf7b7-100b-423d-920f-14f3e33f5f60?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-26T02:16:24Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-fq9v-x83p-g6p3/GHSA-fq9v-x83p-g6p3.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fq9v-x83p-g6p3",
4+
"modified": "2026-02-26T03:31:18Z",
5+
"published": "2026-02-26T03:31:18Z",
6+
"aliases": [
7+
"CVE-2026-2498"
8+
],
9+
"details": "The WP Social Meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/wp-social-meta/tags/1.0.1/wpsm.php#L158"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/wp-social-meta/tags/1.0.1/wpsm.php#L205"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/wp-social-meta/trunk/wpsm.php#L158"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/wp-social-meta/trunk/wpsm.php#L205"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/313906d3-3999-4255-b9ac-580d9d3e80e6?source=cve"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-26T02:16:25Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-hvcw-qp77-8m24/GHSA-hvcw-qp77-8m24.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hvcw-qp77-8m24",
4+
"modified": "2026-02-26T03:31:18Z",
5+
"published": "2026-02-26T03:31:17Z",
6+
"aliases": [
7+
"CVE-2026-1557"
8+
],
9+
"details": "The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1557"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/SBOutputFile.php#L33"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/WPResponsiveImages.php#L265"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/image_handler.php#L28"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/SBOutputFile.php#L33"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/WPResponsiveImages.php#L265"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/image_handler.php#L28"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/22c6f81b-d456-44b9-ba6c-8b207a9ee6e1?source=cve"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-22"
54+
],
55+
"severity": "HIGH",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-02-26T02:16:19Z"
59+
}
60+
}

‎advisories/unreviewed/2026/02/GHSA-jqhg-j5gv-hpmr/GHSA-jqhg-j5gv-hpmr.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
],
3131
"database_specific": {
3232
"cwe_ids": [
33+
"CWE-78",
3334
"CWE-94"
3435
],
3536
"severity": "HIGH",

0 commit comments

Comments
 (0)