Daily summary
Vulnerabilities of 26 October 2026: 63 new, 3 high
63 vulnerabilities added on 26 October 2026, 3 high: Cross-site request forgery in WordPress plugins, SQL injection in WordPress plugins, Cross-site scripting in WordPress plugins and more.
- 3 high
- 40 medium
- 1 low
- 19 unrated
Cross-site request forgery in WordPress plugins
2 vulnerabilities
SQL injection in WordPress plugins
2 vulnerabilities
Cross-site scripting in WordPress plugins
20 vulnerabilities
- 6.5Gallery PhotoBlocks
- 6.5Typing Text – Give your texts many typing effects
- 6.5Button Block
- 6.5Content Slider Block
- 6.5LightBox Block
Show 15 more
- 6.5Gallery PhotoBlocks
- 6.5Amelia
- 6.5JetSmartFilters
- 6.5Advanced Post Block - Post Grid for WordPress block editor
- 6.5Panorama Viewer – 360 Degree Image + Video Viewer
- 6.5B Slider
- 6.5JetElements For Elementor
- 6.5Geo Mashup
- 6.5Better Post & Filter Widgets for Elementor
- 6.5Lazy Load for Videos
- 6.5Ad Inserter
- 6.5Royal Elementor Addons
- 6.5Royal Elementor Addons
- 6.5Gutenberg Blocks by Kadence Blocks
- 6.53d Image Gallery
Broken access control in WordPress plugins
15 vulnerabilities
Race condition in WordPress plugins
2 vulnerabilities
bandit
11 vulnerabilities · Elixir and Erlang packages · most fixed in 1.14.0
- –SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
- –Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
- –HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
- –HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit
- –HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
Show 6 more
- –Quadratic bignum parsing of Content-Length and Host port values in Bandit
- –WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
- –WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
- –Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
- –HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
- –HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
jose
8 vulnerabilities · Elixir and Erlang packages · most fixed in 1.11.13
- –Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
- –ECDSA signature length is not validated in jose, allowing signature malleability
- –erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service
- –Weak PBKDF2 parameters for password-encrypted private-key export in jose
- –Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types
Other vulnerabilities in WordPress plugins
3 vulnerabilities
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.