The TableOn plugin for WordPress (posts-table-filterable), versions up to and including 1.0.7, contains a reflected cross-site scripting vulnerability (CWE-79). An attacker can craft a link or page that injects malicious scripts into the site, which run in the browser of a visitor. Exploitation requires that a user, for example a logged-in administrator, clicks the crafted link or visits the crafted page.
PluginUs.Net · TableOn
LearnPress, a WordPress plugin for creating and selling online courses, contains a missing authorization flaw (CWE-862) in versions up to and including 4.4.11. An unauthenticated remote attacker may be able to access functions or data they should not see, such as other users' information. The CVSS base score is 7.5 with a high impact on confidentiality only; the vulnerable endpoint is not described in the sources, and VulDB rates the issue lower (5.3).
ThimPress · LearnPress
The OceanWP WordPress theme up to and including version 4.2.7 contains a reflected cross-site scripting (XSS) vulnerability (CVE-2026-115592). An attacker can craft a link that injects script into a visitor's browser session on the affected website. The attack requires that a victim opens the crafted link, so the main risk lies with logged-in users, especially administrators. No login is required to prepare the attack.
OceanWP · OceanWP WordPress theme
Research and translation in progress – available shortly.
The WordPress plugin GEO my WordPress (geo-my-wp) in versions up to and including 4.5.5.5 lacks proper authorization checks. According to the CNA, an unauthenticated remote attacker may be able to access functions or data they should not reach, with a high confidentiality impact. Exposure depends on a publicly reachable WordPress site running the affected plugin.
Eyal Fitoussi · GEO my WordPress
The WordPress plugin HANDMADE – Dropshipping for Etsy and WooCommerce up to version 1.0.10 lacks a proper authorization check (CWE-862). According to the CVE record, an authenticated user with low privileges may be able to perform actions they should not be allowed to, which could affect the availability and integrity of data in the WooCommerce shop. The CVSS score is 7.1 (High), but the exact vulnerable function and required privilege level are not documented in the sources reviewed.
VillaTheme · HANDMADE – Dropshipping for Etsy and WooCommerce
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Checkmk trusts a root CA in its bundled CA stores (certifi and, according to some sources, webpki-roots) that chains to eMudhra (emSign) intermediate certificates whose private keys have been compromised. An attacker holding one of these keys could issue certificates for arbitrary host names that would be accepted as valid. Exploitation requires that the attacker can also intercept traffic between Checkmk and a monitored HTTPS endpoint, for example through a man-in-the-middle position.
Checkmk GmbH · Checkmk
Research and translation in progress – available shortly.
The Foxit official website embeds a third-party API token in its JavaScript code, so any visitor can read it. An attacker who obtains the token can submit fake user behavior data and distort Foxit's data statistics. The Foxit bulletin states the token is used to submit user behavior data; the CNA record rates the impact as information disclosure with high confidentiality impact.
Foxit Software Inc. · foxit.com
The online HTML-to-PDF conversion service on Foxit's official website contains a server-side request forgery (SSRF) flaw. By submitting ZIP-formatted input, an unauthenticated remote attacker can bypass restrictions on requests to internal IP addresses and may discover internal network resources. The vulnerability affects Foxit's hosted service, not customer installations, and Foxit states that the fix was released on 29 October 2026.
Foxit Software Inc. · foxit.com HTML-to-PDF conversion service
A broken access control flaw in the online HTML-to-PDF conversion service on Foxit's official website uses a shared token for submitted documents. An unauthenticated remote attacker may be able to access conversion documents submitted by other users. Foxit's bulletin says the issue is fixed on the server side and no customer action is required.
Foxit Software Inc. · foxit.com HTML-to-PDF online service
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The Mapster WP Maps WordPress plugin up to and including version 2.0.5 contains a stored Cross-Site Scripting vulnerability (CWE-79). A map configuration REST endpoint does not check permissions, and the background color value is output without proper escaping in an inline style attribute. An unauthenticated attacker can therefore store script code that runs in the browser of visitors who open an affected page, including logged-in administrators.
Mapster · WP Maps
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
