EventON WordPress Plugin SQL Injection Exposes Database Contents (CVE-2026-9711)

Scope: EventON WordPress Plugin (Versions Affected, Exact Range Unspecified in Source Material)

Severity: High

Read More

Open VSX Registry Stored XSS Enables Supply Chain Attack Against VS Code, Cursor, and Windsurf (CVE-2026-13323)

Scope: Open VSX Registry Versions Prior to 1.0.2 (Affects VS Code, VSCodium, Cursor, Windsurf, and Other Editors)

Severity: High

Read More

RegistrationMagic WordPress Plugin CSRF to Privilege Escalation Granting Admin Access (CVE-2026-12158)

Scope: RegistrationMagic Plugin Versions up to and Including 6.0.9.1

Severity: High

Read More

NEX-Forms WordPress Plugin Unauthenticated Stored XSS via Form Field Name (CVE-2026-12142)

Scope: NEX-Forms Ultimate Forms Plugin for WordPress Versions up to and Including 9.2.2

Severity: High

Read More

CVE-2026-57620 in Exclusive Addons Elementor Plugin

Scope: Exclusive Addons Elementor: from n/a through 2.7.9.8.

Severity: High

Read More

Flowise – Authentication Bypass via Registration Endpoint (CVE-2025-71327)

Scope: Flowise, All Versions Lacking Registration Restrictions

Severity: Critical

 

Read More