rootpwn

critical · CVSS v3 8.1 · CVSS v4 8.6

CVE-2026-104414

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untr…

Description

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.

Scores

Severity
critical
CVSS v2
9.4
CVSS v3
8.1
CVSS v4
8.6
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-94298

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

View analysis

critical

CVE-2026-95102

CVE-2026-95102 exposes WebSocket endpoints in charging station systems that lack authentication, allowing attackers to impersonate stations. This flaw can lead to unauthorized data access and control over charging operations. The vulnerability is rated critical with a CVSS v3 score of 9.4.

View analysis

critical

CVE-2026-93698

CVE-2026-93698 exposes the Multilang adminbin to arbitrary command execution due to insufficient input validation. Attackers can run any system command via the admin interface, potentially compromising the entire host. This flaw is critical and can be exploited remotely by authenticated or unauthenticated users with admin access.

View analysis

critical

CVE-2026-97637

The WordPress JSON API Auth plugin (up to 3.1.2) caches responses without considering HTTP method or POST body, allowing unauthenticated users to retrieve a live admin session cookie from the generate_auth_cookie endpoint. This exposes a valid Administrator logged_in cookie that can be used to impersonate the site admin. The flaw requires the PI-Media/json-api parent plugin to be active and an admin to have posted to the endpoint within the 24‑hour cache TTL.

View analysis