Skip to content

Commit acb06f3

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 44f7775 commit acb06f3

193 files changed

Lines changed: 6423 additions & 3 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/04/GHSA-264c-x5mq-ppr2/GHSA-264c-x5mq-ppr2.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-264c-x5mq-ppr2",
4+
"modified": "2026-04-08T09:31:35Z",
5+
"published": "2026-04-08T09:31:35Z",
6+
"aliases": [
7+
"CVE-2026-39696"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elfsight Elfsight WhatsApp Chat CC elfsight-whatsapp-chat allows DOM-Based XSS.This issue affects Elfsight WhatsApp Chat CC: from n/a through <= 1.2.0.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39696"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://patchstack.com/database/Wordpress/Plugin/elfsight-whatsapp-chat/vulnerability/wordpress-elfsight-whatsapp-chat-cc-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-79"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-08T09:16:42Z"
30+
}
31+
}

‎advisories/unreviewed/2026/04/GHSA-26j4-477q-gv33/GHSA-26j4-477q-gv33.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-26j4-477q-gv33",
4+
"modified": "2026-04-08T09:31:32Z",
5+
"published": "2026-04-08T09:31:32Z",
6+
"aliases": [
7+
"CVE-2026-39541"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.This issue affects Hydra Booking: from n/a through <= 1.1.38.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39541"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://patchstack.com/database/Wordpress/Plugin/hydra-booking/vulnerability/wordpress-hydra-booking-plugin-1-1-38-cross-site-scripting-xss-vulnerability?_s_id=cve"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-79"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-08T09:16:26Z"
30+
}
31+
}

‎advisories/unreviewed/2026/04/GHSA-295f-cjg2-fv68/GHSA-295f-cjg2-fv68.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-295f-cjg2-fv68",
4+
"modified": "2026-04-08T09:31:36Z",
5+
"published": "2026-04-08T09:31:36Z",
6+
"aliases": [
7+
"CVE-2026-39713"
8+
],
9+
"details": "Missing Authorization vulnerability in mailercloud Mailercloud &#8211; Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize-contacts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mailercloud &#8211; Integrate webforms and synchronize website contacts: from n/a through <= 1.0.7.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39713"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://patchstack.com/database/Wordpress/Plugin/mailercloud-integrate-webforms-synchronize-contacts/vulnerability/wordpress-mailercloud-integrate-webforms-and-synchronize-website-contacts-plugin-1-0-7-broken-access-control-vulnerability?_s_id=cve"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-862"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-08T09:16:44Z"
30+
}
31+
}

‎advisories/unreviewed/2026/04/GHSA-2chh-fcwm-p667/GHSA-2chh-fcwm-p667.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2chh-fcwm-p667",
4+
"modified": "2026-04-08T09:31:35Z",
5+
"published": "2026-04-08T09:31:35Z",
6+
"aliases": [
7+
"CVE-2026-39691"
8+
],
9+
"details": "Missing Authorization vulnerability in AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations cryptocurrency-donation-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Donation Box – Bitcoin & Crypto Donations: from n/a through <= 2.2.13.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39691"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://patchstack.com/database/Wordpress/Plugin/cryptocurrency-donation-box/vulnerability/wordpress-cryptocurrency-donation-box-bitcoin-crypto-donations-plugin-2-2-13-broken-access-control-vulnerability?_s_id=cve"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-862"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-08T09:16:41Z"
30+
}
31+
}

‎advisories/unreviewed/2026/04/GHSA-2j6r-34xw-23mj/GHSA-2j6r-34xw-23mj.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2j6r-34xw-23mj",
4+
"modified": "2026-04-08T09:31:32Z",
5+
"published": "2026-04-08T09:31:32Z",
6+
"aliases": [
7+
"CVE-2026-39544"
8+
],
9+
"details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek LabtechCO labtechco allows PHP Local File Inclusion.This issue affects LabtechCO: from n/a through <= 8.3.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39544"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://patchstack.com/database/Wordpress/Theme/labtechco/vulnerability/wordpress-labtechco-theme-8-3-local-file-inclusion-vulnerability?_s_id=cve"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-98"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-08T09:16:27Z"
30+
}
31+
}

‎advisories/unreviewed/2026/04/GHSA-2mpg-m27w-5p6f/GHSA-2mpg-m27w-5p6f.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2mpg-m27w-5p6f",
4+
"modified": "2026-04-08T09:31:32Z",
5+
"published": "2026-04-08T09:31:32Z",
6+
"aliases": [
7+
"CVE-2026-39504"
8+
],
9+
"details": "Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.2.5.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39504"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://patchstack.com/database/Wordpress/Plugin/instawp-connect/vulnerability/wordpress-instawp-connect-plugin-0-1-2-5-broken-access-control-vulnerability?_s_id=cve"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-862"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-08T09:16:24Z"
30+
}
31+
}

‎advisories/unreviewed/2026/04/GHSA-2mw3-cgxq-9prq/GHSA-2mw3-cgxq-9prq.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2mw3-cgxq-9prq",
4+
"modified": "2026-04-08T09:31:33Z",
5+
"published": "2026-04-08T09:31:33Z",
6+
"aliases": [
7+
"CVE-2026-39575"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through <= 5.5.0.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39575"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://patchstack.com/database/Wordpress/Plugin/post-type-archive-mapping/vulnerability/wordpress-custom-query-blocks-plugin-5-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-79"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-08T09:16:28Z"
30+
}
31+
}

‎advisories/unreviewed/2026/04/GHSA-2qmh-3x75-j23v/GHSA-2qmh-3x75-j23v.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2qmh-3x75-j23v",
4+
"modified": "2026-04-08T09:31:35Z",
5+
"published": "2026-04-08T09:31:35Z",
6+
"aliases": [
7+
"CVE-2026-39679"
8+
],
9+
"details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Freeio freeio allows PHP Local File Inclusion.This issue affects Freeio: from n/a through <= 1.3.21.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39679"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://patchstack.com/database/Wordpress/Theme/freeio/vulnerability/wordpress-freeio-theme-1-3-21-local-file-inclusion-vulnerability?_s_id=cve"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-98"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-08T09:16:39Z"
30+
}
31+
}

‎advisories/unreviewed/2026/04/GHSA-2qvj-7467-692p/GHSA-2qvj-7467-692p.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2qvj-7467-692p",
4+
"modified": "2026-04-08T09:31:33Z",
5+
"published": "2026-04-08T09:31:33Z",
6+
"aliases": [
7+
"CVE-2026-39611"
8+
],
9+
"details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes KuteShop kuteshop allows PHP Local File Inclusion.This issue affects KuteShop: from n/a through <= 4.2.9.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39611"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://patchstack.com/database/Wordpress/Theme/kuteshop/vulnerability/wordpress-kuteshop-theme-4-2-9-local-file-inclusion-vulnerability?_s_id=cve"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-98"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-08T09:16:30Z"
30+
}
31+
}

‎advisories/unreviewed/2026/04/GHSA-338c-7gw3-rg6c/GHSA-338c-7gw3-rg6c.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-338c-7gw3-rg6c",
4+
"modified": "2026-04-08T09:31:34Z",
5+
"published": "2026-04-08T09:31:34Z",
6+
"aliases": [
7+
"CVE-2026-39638"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.14.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39638"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://patchstack.com/database/Wordpress/Plugin/qubely/vulnerability/wordpress-qubely-plugin-1-8-14-cross-site-scripting-xss-vulnerability?_s_id=cve"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-79"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2026-04-08T09:16:34Z"
30+
}
31+
}

0 commit comments

Comments
 (0)