keyboard_arrow_up

CVEs

Vulnerabilities I reported, with public advisories, affected versions and fixes. Related research is linked where available.

5 CVEs · Latest advisories first Updated October 7, 2026

CVE-2026-102173

CVSS 7.2 · High
Kirki · WordPress

Unauthenticated stored cross-site scripting via registration metadata

Affected
Through 6.3.1
Fixed in
6.3.2
CVE.org Wordfence advisory
Details

Insufficient output escaping of registration metadata could allow unauthenticated users to store scripts that execute when a visitor views an affected Kirki users collection. Exposure requires public user registration and a published Kirki registration form, with a collection image using the affected metadata.

CVE-2026-96837

CVSS 8.8 · High
CartFlows · WordPress

Contributor remote code execution

↓ 11,049,982 WordPress downloads Including updates ·
Affected
Through 3.2.0
Fixed in
3.2.1
CVE.org Patchstack advisory
Details

A user with Contributor-level privileges could execute arbitrary code on the server through the CartFlows plugin.

CVE-2026-94504

CVSS 7.2 · High
Ninja Forms · WordPress

Unauthenticated stored cross-site scripting

↓ 63,819,545 WordPress downloads Including updates ·
Affected
Through 3.15.3
Fixed in
3.15.4
CVE.org Wordfence advisory
Details

Insufficient input sanitization and output escaping could allow unauthenticated users to store scripts that execute when an affected page is viewed.

CVE-2026-81180

CVSS 8.8 · High
SysReptor Professional

Authenticated remote code execution

Affected
Through 2026.55 (vendor advisory)
Fixed in
2026.61 (2026.58 provides a partial mitigation)
CVE.org SysReptor advisory Research ↗
Details

Insecure image processing could allow authenticated users to execute code with the privileges of the application process. The Community edition is not affected.

CVE-2026-81179

CVSS 8.1 · High
SysReptor

Host header injection / account takeover

Affected
Through 2026.55 (vendor advisory)
Fixed in
2026.58
CVE.org SysReptor advisory Research ↗
Details

Password-reset links could use an untrusted host, potentially allowing account takeover when a victim follows the link. Exposure depends on the deployment configuration and password reset being enabled.