Mutantgun

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'post types', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi debug array() function in lib/debug.php, which dumps user-supplied query variables through print r() inside a <pre> block without HTML escaping. The debug path is enabled by supplying the relevanssi debug=on request parameter when the administrator has previously enabled the 'Debugging mode' setting; the gate itself is a configuration check with no capability, nonce, or logged-in check (the vendor explicitly suppresses nonce verification on that line). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

🚨 CVE-2026-18056 The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate user function's Facebook authenticator resolving third-party identity by forwarding the attacker-supplied access token to the Facebook Graph API and trusting the returned email and ID verbatim, without performing any application ID or audience validation — specifically, no /debug token verification and no comparison of the token's app id against the configured hp facebook app id. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, whose email address is associated with a Facebook account for which the attacker can obtain any valid access token. Important Note: To exploit the vulnerability, the attacker must obtain the victim's access token. 🎖@cveNotify

🚨 CVE-2026-77826 The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled. 🎖@cveNotify

🚨 CVE-2026-82846 The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator. 🎖@cveNotify