https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T21:52:44.518459+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-281538 EUVD-2026-281538 2026-10-06T21:52:44.567221+00:00 EUVD-2026-281538 https://cve.radiocsirt.org/vuln/fkie_cve-2024-13419 fkie_cve-2024-13419 2026-10-06T21:52:44.567315+00:00

Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions() and importThemeOptions() functions in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings which includes custom JavaScript that is enabled site-wide. This issue was escalated to Envato over two months from the date of this disclosure and the issue is still vulnerable.

 https://cve.radiocsirt.org/vuln/ghsa-hhv8-q584-2mj6 GHSA-hhv8-q584-2mj6 2026-10-06T21:52:44.567352+00:00

Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions() and importThemeOptions() functions in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings which includes custom JavaScript that is enabled site-wide. This issue was escalated to Envato over two months from the date of this disclosure and the issue is still vulnerable.