Vulnerabilities

CVE-2026-14962 is an unauthenticated SQL injection flaw (CWE-89) in the ELEX WooCommerce Request a Quote WordPress plugin, caused by insufficient sanitisation and escaping of a parameter before it is used in a SQL query. Because the vulnerable code path requires no authentication, any unauthenticated visitor to a site running the plugin can inject SQL through the affected parameter. Successful exploitation allows the attacker to extract arbitrary data from the WordPress database, which may include sensitive tables such as user accounts and order data; the CVSS scoring (8.6, confidentiality-high) indicates impact is limited to data disclosure, with no integrity or availability loss. Only WooCommerce stores running versions of the plugin before 2.4.1 are affected. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

Do: Sites running the ELEX WooCommerce Request a Quote plugin should upgrade to version 2.4.1 or later. If an immediate upgrade is not possible, consider virtual patching via a WAF (e.g., blocking SQL metacharacters in the vulnerable parameter) and monitor web/database logs for anomalous queries. Because exploitation may be silent, also review whether sensitive database content such as user credentials may have been accessed.

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress, in all versions up to and including 4.1.22, is vulnerable to a Local File Inclusion (CWE-98) via the 'event_layout' parameter. Any authenticated user with contributor-level access or above can trigger the flaw through the REST API, because the default 'etn_manage_event' capability is assigned to Contributors and allows setting a malicious 'event_layout' value. Successful exploitation causes the server to include and execute arbitrary local .php files, letting the attacker run any PHP code in those files, which can bypass access controls or expose sensitive data, and can lead to full code execution where .php uploads can be made and included. Any WordPress site running Eventin 4.1.22 or earlier that has contributor-level or higher user accounts is affected. There is no known public proof-of-concept, the flaw is not in the CISA KEV catalog, and current exploitation appears unlikely (EPSS ~0.6% over 30 days).

Do: Update Eventin to the latest patched release (any version newer than 4.1.22) as soon as one is available. Until patched, audit sites for contributor-level or higher accounts that could set 'event_layout' values via the REST API, consider revoking the 'etn_manage_event' capability from Contributors as an interim mitigation, and check whether any .php file uploads exist on the server that could be included for full code execution.

CVE-2026-87528 is a type confusion flaw (CWE-843) in Rust-based code in Google Chrome on Windows. A remote attacker can trigger it by persuading a user to open a crafted HTML page, causing incorrect type handling in memory. Successful exploitation potentially allows execution of arbitrary code outside the browser sandbox, meaning an attacker's code would run beyond Chrome's renderer-level containment. Users running Google Chrome on Windows prior to 153.0.8010.36 are affected; no other products or platforms are named in the advisory. No in-the-wild exploitation is currently known: the flaw is not in CISA's KEV, EPSS assigns a 0.2% 30-day exploitation probability, and while the CVSS base score is 9.6 (critical), the Chromium project itself rates the issue Medium; one public reference (Chromium issue 539569491) exists.

Do: Update Google Chrome on Windows to 153.0.8010.36 or later, verifying the installed version at chrome://settings/help or chrome://version. No workaround that prevents the type confusion is documented, so prioritize patching, especially for users who browse untrusted web content; note the vendor severity is Medium but the flaw can yield code execution outside the sandbox. Technical details may emerge at Chromium issue 539569491, worth monitoring for indicators or exploit development.

CVE-2026-80093 is a use-after-free memory-safety flaw (CWE-416) in the Windows Cloud Files Mini Filter Driver (cldflt.sys), the in-box kernel filesystem filter that backs cloud placeholder files via the Cloud Files API. An attacker who already holds valid low-privilege credentials on a host triggers the flaw through specific operations against cloud-files placeholders, causing the driver to reference freed kernel memory; the High attack-complexity rating indicates the required conditions do not line up trivially. A successful exploit elevates the attacker's privileges locally, granting full control of the affected machine with high impact to confidentiality, integrity, and availability — the flaw is not remotely exploitable on its own. Virtually every maintained Windows 10/11 and Windows Server deployment ships this driver, so any Windows host where untrusted users can run code is plausibly affected; the available data does not list specific affected builds, and fixes shipped in Microsoft's September 2026 Patch Tuesday. As of the data available there is no public PoC, the CVE is not in CISA KEV, and EPSS is low (0.3%, 28th percentile), indicating no confirmed exploitation in the wild; while the September 2026 release included two zero-days, whether this CVE is among them is not confirmed here.

Do: Apply Microsoft's September 2026 Windows cumulative security updates to all Windows 10/11 clients and Windows Servers, prioritizing multi-user hosts such as RDS/VDI servers, terminal servers, and shared workstations where local logon is common. Because exploitation requires valid local credentials, an interim mitigation is to restrict interactive logon, RDP, and local account creation to trusted users on unpatched hosts. After patching, verify on critical systems that the updated cldflt.sys file version from the September 2026 update is in place.

CVE-2026-69451 is a use-after-free (CWE-416) in Windows Management Instrumentation (WMI), the core management infrastructure component of Microsoft Windows. An authorized attacker holding only a low-privileged account can reach the flaw over a network and trigger it with user interaction and under high attack complexity, likely by racing WMI operations to free and reuse an object. Successful exploitation grants the attacker elevated privileges on the target system, with high confidentiality, integrity, and availability impact per the CVSS 7.1 score. All Windows systems carrying the affected WMI component are potentially affected; the available data does not specify exact affected version ranges or builds, so defenders should consult Microsoft's advisory. Exploitation has not yet been added to CISA KEV and EPSS is only ~0.7% (50th percentile), but one public proof-of-concept is available, and no confirmed in-the-wild exploitation is documented.

Do: Install the Microsoft security update for CVE-2026-69451 as soon as it is available through Windows Update/WSUS, checking Microsoft's advisory for the exact affected builds since version ranges are not listed in the source data. Prioritize patching multi-user hosts such as RDS/VDI servers where low-privileged remote users log in, since exploitation requires an authorized account plus user interaction. Note that a public PoC exists, so monitor WMI-related process and event logs for anomalous activity until systems are patched.

CVE-2026-52307 is an authenticated stored cross-site scripting (XSS) flaw in the Column Management component of ClassCMS 1CMS v5.6. An authenticated user can inject a crafted payload into the title field of a column, which is then stored and executed as arbitrary web scripts or HTML when other users view the affected content. Successful exploitation allows the attacker to run attacker-controlled scripts in the browsers of users who view the injected column, potentially enabling actions such as session hijacking or performing actions under victims' credentials. Only deployments of 1CMS v5.6 are identified as affected in the disclosure. There is no confirmed in-the-wild exploitation: the flaw is not in CISA KEV, EPSS estimates only a 0.3% probability of exploitation in the next 30 days, and one public proof-of-concept reference exists on GitHub.

Do: Audit whether you run 1CMS and confirm the version; operators of v5.6 should restrict which authenticated accounts can edit column titles and sanitize/validate title input as an interim mitigation. Watch the vendor and the referenced PoC (github.com/linan-OO/CVE-2026-52307) for a patched release, and upgrade as soon as a fixed version is published, since no fixed version is specified in the current disclosure. Given the low EPSS score, absence from CISA KEV, and the authentication requirement, treat this as a lower-priority patch pending vendor guidance.

XenForo before 2.3.13 fails to invalidate or mark OAuth2 authorization codes as consumed after they are redeemed, breaking the single-use guarantee of the OAuth2 authorization code flow (CWE-294 capture/replay). An attacker who obtains an authorization code — for example one intercepted in transit or one already used by the legitimate client — can submit it again to the token endpoint and receive an independent, valid token pair. The attacker gains API access with the same user identity and scopes as the original grant, without needing the user's credentials, consistent with the high confidentiality and integrity ratings in the CVSS 4.0 score of 9.1. The issue affects XenForo installations that operate the built-in OAuth2 authorization server (REST API/connected apps) on versions prior to 2.3.13; the high attack complexity reflects the need to possess a reusable code. No in-the-wild exploitation is known: one public proof-of-concept exists on GitHub, the flaw is not in CISA KEV, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

Do: Upgrade all XenForo instances to 2.3.13 or later, prioritizing forums that expose the REST API/OAuth2 server. Until patched, limit OAuth2 clients to trusted applications, revoke and re-issue tokens for any user whose authorization traffic could have been observed, and check token-endpoint logs for the same authorization code being redeemed more than once. Because reused codes yield independent token pairs, assume any replayed code in logs may indicate an attacker-held duplicate token.