Our news and updates

In the Responsive Header plugin for WordPress versions up to and including 1.0 a medium severity vulnerability CVE-2026-1300 was detected. This vulnerability allows authenticated attackers with administrator-level access or higher to inject arbitrary web scripts via multiple plugin settings parameters, which are stored and executed when users access affected pages, due to insufficient input sanitization and output escaping. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1300.

In the Postalicious plugin for WordPress versions up to and including 3.0.1 a medium severity vulnerability CVE-2026-1266 was detected. This vulnerability allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts via admin settings, which are stored and executed when users access affected pages, due to insufficient input sanitization and output escaping. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1266.

In the Administrative Shortcodes plugin for WordPress versions up to, and including, 0.3.4 a high severity vulnerability CVE-2026-1257 was detected. This vulnerability allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary files on the server via the slug attribute of the get_template shortcode, due to insufficient path validation of user-supplied input passed to the get_template_part() function. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1257.

In the LeadBI plugin for WordPress versions up to and including 1.7 a medium severity vulnerability CVE-2026-1189 was detected. This vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the form_id parameter of the leadbi_form shortcode, due to insufficient input sanitization and output escaping of user-supplied attributes. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1189.

In the Meta-box GalleryMeta plugin for WordPress versions up to and including 3.0.1 a medium severity vulnerability CVE-2026-1302 was detected. This vulnerability allows authenticated attackers with editor-level permissions or higher to inject arbitrary malicious scripts via the admin settings, leading to stored cross-site scripting (XSS) that executes whenever a user accesses the affected pages. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1302.

In Moodle version 3.10.3 a high severity vulnerability CVE-2021-47857 was detected. This vulnerability allows attackers to inject malicious JavaScript into the calendar event subtitle (label) field, resulting in persistent cross-site scripting that executes arbitrary code when users view the affected event. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2021-47857.

In Backstage and the @backstage/backend-defaults package versions prior to 0.12.2, 0.13.2, 0.14.1, and 0.15.0 a low severity vulnerability CVE-2026-24048 was detected. This vulnerability allows attackers who control an allowed external host to perform Server-Side Request Forgery (SSRF) by abusing automatic HTTP redirect handling in the FetchUrlReader component, enabling access to internal or sensitive URLs that are not explicitly allowlisted. To address this issue, users should upgrade @backstage/backend-defaults to versions 0.12.2, 0.13.2, 0.14.1, 0.15.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24048.

In Backstage using the @backstage/backend-plugin-api package versions prior to 0.1.17 a medium severity vulnerability CVE-2026-24047 was detected. This vulnerability allows attackers to bypass path traversal protections by abusing improperly validated symlink chains or dangling symlinks in the resolveSafeChildPath utility, potentially enabling file operations to access or modify files outside of intended directories. To address this issue, users should upgrade @backstage/backend-plugin-api to version 0.1.17 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24047.

In Backstage versions prior to @backstage/backend-defaults 0.12.2, 0.13.2, 0.14.1, and 0.15.0; @backstage/plugin-scaffolder-backend 2.2.2, 3.0.2, and 3.1.1; and @backstage/plugin-scaffolder-node 0.11.2 and 0.12.3 a high severity vulnerability CVE-2026-24046 was detected. This vulnerability allows attackers with permission to create or execute Scaffolder templates to exploit symlink-based path traversal issues to read arbitrary files, delete files outside the workspace, or write files to unintended locations via vulnerable Scaffolder actions and archive extraction utilities. To address this issue, users should upgrade @backstage/backend-defaults to versions 0.12.2, 0.13.2, 0.14.1, 0.15.0, @backstage/plugin-scaffolder-backend to versions 2.2.2, 3.0.2, 3.1.1 and @backstage/plugin-scaffolder-node to versions 0.11.2 or 0.12.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24046.