These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content through Email Log Body in versions up to and including 1.2.3. This vulnerability allows unauthenticated attackers to inject web scripts into pages, which are executed when a user accesses the injected page. The exploit is possible because WordPress comment kses does not strip entity-encoded tag delimiters, [truncated]
The Backuply plugin for WordPress, version 1.5.8 and earlier, is vulnerable to SQL injection via the Biographical Info field during the restore process. This allows authenticated attackers with subscriber-level access to escalate privileges by injecting malicious SQL, potentially leading to full site takeover. The vulnerability is caused by insufficient escaping on user-supplied parameters and the lack of [truncated]
A critical vulnerability exists in Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0, allowing unauthenticated remote attackers to execute arbitrary code as root via a PHP object injection vulnerability in the billing module handler. This vulnerability enables attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the from_billing_module [truncated]
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever [truncated]
CVE-2026-2470 is an Incorrect Authorization vulnerability in the Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress. The vulnerability affects all versions up to, and including, 2.0.9. The issue arises from the pagelayer_save_content AJAX handler, which allows users with basic post-edit capability to persist pagelayer_contact_templates metadata on posts they can edit, including p [truncated]
The CVE-2026-2509 vulnerability is a Stored Cross-Site Scripting issue in the Pagelayer plugin for WordPress. This vulnerability affects all versions up to, and including, 2.0.8. The issue arises from an incomplete event handler blocklist in the 'pagelayer_xss_content' XSS filtering function, which fails to block all event handlers. This allows authenticated attackers with Contributor-level access and abo [truncated]
CVE-2026-39469 is a MEDIUM-severity vulnerability in PageLayer, a WordPress plugin. It allows attackers to retrieve embedded sensitive data. The issue affects PageLayer versions from n/a through 2.0.8. This type of vulnerability could lead to unauthorized access to sensitive information, potentially impacting confidentiality. Users should review the official CVE record and NVD details for further information.
