Most recent entries from nvd

CVE-2026-97415 — btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF

Thu, 24 Sep 2026 16:03:22 +0000

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF

ROOT_REF and ROOT_BACKREF items contain a struct btrfs_root_ref followed by the subvolume name. Several readers assume that this layout is already valid and then use the on-disk name length directly. A corrupted item can therefore make those readers address bytes outside the item, and BTRFS_IOC_GET_SUBVOL_INFO can copy too many bytes into its fixed-size UAPI name buffer.

Validate ROOT_REF and ROOT_BACKREF items in tree-checker before any reader uses them. Reject records that do not contain a non-empty name, whose name_len does not exactly describe the remaining item payload, or whose name exceeds BTRFS_NAME_LEN.

For BTRFS_IOC_GET_SUBVOL_INFO, copy only the validated on-disk name_len instead of deriving the copy length from the item size. The ioctl result is zeroed when allocated. That leaves the existing trailing zero byte untouched.

CVE-2026-97219 — MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter

Fri, 02 Oct 2026 06:56:54 +0000

Affected: Unknown MStore API

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.

CVE-2026-93698

Fri, 02 Oct 2026 06:20:33 +0000

Affected: Webpros cPanel, Webpros WP Squared

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

CVE-2026-93697

Fri, 02 Oct 2026 06:20:44 +0000

Affected: Webpros cPanel, Webpros WP Squared

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

CVE-2026-93029

Fri, 02 Oct 2026 06:20:47 +0000

Affected: Webpros cPanel, Webpros WP Squared

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

CVE-2026-92924 — Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data

Fri, 02 Oct 2026 06:56:53 +0000

Affected: Unknown Unlimited Elements for Elementor

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.

CVE-2026-91020 — WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount

Fri, 02 Oct 2026 06:56:52 +0000

Affected: Unknown WebToffee Gift Cards for WooCommerce

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the configured denominations and manipulating the order total to obtain products without paying.

CVE-2026-90987 — Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price

Fri, 02 Oct 2026 06:56:52 +0000

Affected: Unknown Easy PayPal & Stripe Buy Now Button

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase.

CVE-2026-90952 — WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API

Fri, 02 Oct 2026 06:56:51 +0000

Affected: Unknown WP Edit Password Protected

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.

CVE-2026-85005 — Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization

Fri, 02 Oct 2026 06:56:50 +0000

Affected: Unknown Popup Maker WP

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as zero-argument PHP callables on public page loads, leading to sensitive information disclosure and denial of service.