Security Digest: September 25, 2026 - 38 Critical Vulnerabilities

Today’s digest is dominated by remote code execution, privilege escalation, and cross-site scripting flaws in widely deployed web platforms, developer tools, and WordPress plugins. Several issues are exploitable by unauthenticated attackers, and at least one developer-facing product allows cross-origin WebSocket hijacking that can lead to local command execution.

2026-09-25 · 23 min read

Executive Summary

Today’s digest is dominated by remote code execution, privilege escalation, and cross-site scripting flaws in widely deployed web platforms, developer tools, and WordPress plugins. Several issues are exploitable by unauthenticated attackers, and at least one developer-facing product allows cross-origin WebSocket hijacking that can lead to local command execution. Patch exposed internet-facing systems first, then audit any WordPress, IDE, build, and XML-processing components still on older releases.

Critical Vulnerabilities

CVE-2026-59167: SUNEDITOR custom-tag XSS
- Impact: Stored or reflected JavaScript can run in users’ browsers through crafted namespaced HTML elements.
- Affected Systems: npm suneditor <= 2.47.10.
- Immediate Action: Block untrusted HTML input now and search for any use of SUNEDITOR in customer-facing editors.
- Mitigation: Upgrade to a patched release and add regression tests for custom/namespaced tags.
CVE-2026-61741: http4s-scala-xml XXE
- Impact: Attackers can read local files, trigger SSRF, or cause denial of service via malicious XML.
- Affected Systems: org.http4s:http4s-scala-xml_2.12, _2.13, _3.
- Immediate Action: Treat all XML bodies as hostile and disable untrusted XML parsing until upgraded.
- Mitigation: Upgrade; if blocked, harden the SAX parser with secure processing and DOCTYPE/entity restrictions.
CVE-2026-93399: Bookly IDOR
- Impact: Unauthenticated attackers can expose booking tokens, calendar data, and delete appointments.
- Affected Systems: WordPress Bookly plugin up to 28.2.
- Immediate Action: Restrict public booking endpoints and review any exposed AJAX actions immediately.
- Mitigation: Update Bookly and verify no unauthenticated access to booking management actions.
CVE-2026-89055: Customer Reviews for WooCommerce authorization bypass
- Impact: Attackers can delete arbitrary Media Library attachments, including admin-owned assets.
- Affected Systems: WordPress plugin up to 5.120.0.
- Immediate Action: Suspend review form flows that expose public form IDs until patched.
- Mitigation: Upgrade immediately and audit deleted media records for abuse.
CVE-2026-62062: Elementor CSRF
- Impact: Attackers can trick logged-in users into unwanted actions.
- Affected Systems: Elementor Website Builder through 4.3.1.
- Immediate Action: Limit admin access and review any exposed Elementor actions behind weak nonce checks.
- Mitigation: Upgrade and verify CSRF protections on all admin workflows.
CVE-2026-19804: s2Member RCE
- Impact: Unauthenticated attackers can execute code on the server under specific configuration conditions.
- Affected Systems: s2Member up to 260814.
- Immediate Action: Disable Signup Tracking Codes templates using %%first_name%% until patched.
- Mitigation: Upgrade and rotate any exposed proxy verification key.
CVE-2026-89426: Knit Pay privilege escalation
- Impact: Subscribers can elevate to administrator by tampering with a form field.
- Affected Systems: Knit Pay up to 9.6.1.0.
- Immediate Action: Audit Gravity Forms feeds and disable role-mapping flows now.
- Mitigation: Update and restrict role assignment to server-side allowlists only.
CVE-2026-59723: Cline Hub CSWSH leading to local command execution
- Impact: A malicious website can connect to a local dashboard, read workspace state, alter settings, and trigger command execution.
- Affected Systems: npm cline / @cline/cline-hub dashboard, especially default localhost setups.
- Immediate Action: Stop running the dashboard on default settings until patched; do not browse untrusted sites while it is open.
- Mitigation: Upgrade, set a strong room secret, and enforce Origin validation.
CVE-2026-85057: ZITADEL Actions V1 filesystem read
- Impact: Organization owners can read host files and potentially steal bootstrap credentials.
- Affected Systems: ZITADEL 3.x and 4.x versions listed in the advisory.
- Immediate Action: Restrict who can write Actions and review all custom Actions for filesystem access.
- Mitigation: Upgrade to the fixed release and remove readable bootstrap secrets from the API container.
CVE-2026-63498: Snipe-IT API inline XML XSS
- Impact: Authenticated attackers can execute JavaScript in another user’s Snipe-IT session.
- Affected Systems: Snipe-IT versions around v8.6.3-231-gdf8e3b1443 and related API file-serving paths.
- Immediate Action: Block inline rendering of uploaded XML files until patched.
- Mitigation: Upgrade to the fixed commit and verify safe-inline handling on API downloads.
CVE-2026-97818: phpIPAM authorization flaw
- Impact: Incorrect authorization for admin/all IDs can expose privileged actions or data.
- Affected Systems: phpIPAM through 1.8.3.
- Immediate Action: Review any API calls targeting admins or all identifiers.
- Mitigation: Upgrade and re-test access controls on all user-management endpoints.
CVE-2026-57171: compliance-trestle arbitrary file write
- Impact: Trusted automation can be tricked into writing files outside the workspace.
- Affected Systems: pip compliance-trestle.
- Immediate Action: Treat any externally influenced --output value as unsafe and stop automated generation jobs if untrusted input is involved.
- Mitigation: Patch and verify output-path validation on all author generate commands.
CVE-2026-85056: ZITADEL Login V2 MFA bypass
- Impact: Password-only sessions can be reused to complete login without verifying the second factor.
- Affected Systems: ZITADEL 4.x through 4.16.0 using Login V2.
- Immediate Action: Enable Force MFA immediately where possible.
- Mitigation: Upgrade to 4.16.1 or later.
CVE-2026-56736: phpMyFAQ stored XSS in admin editor
- Impact: Attackers can plant script that executes when admins review FAQ entries.
- Affected Systems: phpMyFAQ / thorsten/phpmyfaq under the affected versions.
- Immediate Action: Disable guest FAQ submissions if enabled and inspect recent FAQ content.
- Mitigation: Upgrade and sanitize stored FAQ content before admin rendering.
CVE-2026-92713: Modula arbitrary file deletion
- Impact: Authenticated authors can delete arbitrary files on the server.
- Affected Systems: Modula Image Gallery up to 3.0.2.
- Immediate Action: Restrict author-level upload/delete permissions on affected sites.
- Mitigation: Patch immediately and verify file-path validation.
CVE-2026-62368: Snipe-IT custom field XSS
- Impact: Lower-privileged users can execute script in superuser sessions by naming custom fields maliciously.
- Affected Systems: Snipe-IT installations with custom field creation enabled.
- Immediate Action: Search for suspicious custom field names and disable field creation for non-admins.
- Mitigation: Apply the vendor patch and escape all asset-list header titles.
CVE-2026-56737: phpMyFAQ 2FA login bypass
- Impact: Attackers can authenticate to any 2FA-enabled account with only a valid TOTP code.
- Affected Systems: phpMyFAQ / thorsten/phpmyfaq.
- Immediate Action: Review exposed login endpoints and enforce stronger throttling immediately.
- Mitigation: Upgrade and require password verification before any 2FA completion step.
CVE-2026-12958: AWS Language Servers symlink write
- Impact: Malicious workspaces can cause writes outside the trusted workspace boundary.
- Affected Systems: AWS Language Servers < 1.69.0, including tooling used by Amazon Q Developer.
- Immediate Action: Do not open untrusted repositories in affected IDE workflows.
- Mitigation: Upgrade to 1.69.0 or later.
CVE-2026-61816: mail-mime-parser denial of service
- Impact: Crafted email can consume excessive CPU or memory and crash services.
- Affected Systems: zbateson/mail-mime-parser versions before the fixed release.
- Immediate Action: Put hard limits on untrusted mail parsing workloads now.
- Mitigation: Upgrade and enforce parsing limits at the application boundary.
CVE-2026-61782: Rsdoctor unauthenticated source code leak
- Impact: Attackers on the network can retrieve source code, build configs, and environment data.
- Affected Systems: npm @rsdoctor/rspack-plugin 1.5.11 and similar vulnerable builds.
- Immediate Action: Disable exposed report servers and block access from untrusted networks.
- Mitigation: Upgrade to the patched release and bind the service locally.
CVE-2026-57231: podman environment variable leak
- Impact: A malicious image can exfiltrate host environment variables from the launch session.
- Affected Systems: Podman v2, v3, v4, v5, and v6 lines listed in the advisory.
- Immediate Action: Avoid running untrusted images and inspect image configs before launch.
- Mitigation: Upgrade to the fixed commit and reject malformed environment entries.
CVE-2026-57178: social-auth-core VK callback trust flaw
- Impact: Unsigned callback data can be treated as a verified identity.
- Affected Systems: pip social-auth-core using the VK app backend.
- Immediate Action: Disable the VK app backend until patched.
- Mitigation: Require a valid auth_key and upgrade.
CVE-2026-97737: Wakapi account takeover
- Impact: User cache lookup can resolve in the wrong context, leading to account takeover.
- Affected Systems: Wakapi before 2.17.6.
- Immediate Action: Rotate sessions and review authentication logs for anomalous cache hits.
- Mitigation: Upgrade immediately.
CVE-2026-61788: DBHub read-only bypass
- Impact: SQL classified as read-only can still write data, read files, or execute commands in privileged contexts.
- Affected Systems: npm @bytebase/dbhub up to 0.22.2.
- Immediate Action: Do not expose the MCP endpoint to untrusted callers.
- Mitigation: Upgrade and verify engine-level read-only enforcement is active.
CVE-2026-93901: Optima Express IDX privilege escalation
- Impact: Unauthenticated attackers can elevate a pre-registered account to Author.
- Affected Systems: Optima Express IDX up to 8.7.5.
- Immediate Action: Disable open registration or block the affected AJAX action.
- Mitigation: Patch and confirm capability checks on credential provisioning.
CVE-2026-84279: Fancy Product Designer stored XSS
- Impact: Attackers can inject script that runs when exported content is viewed.
- Affected Systems: Fancy Product Designer up to 6.5.2.
- Immediate Action: Disable Pro Export/Genius if enabled and inspect stored output formats.
- Mitigation: Upgrade and sanitize output_format before storage.
CVE-2026-96039: BA Book Everything stored XSS
- Impact: Guest bookings can carry script that later executes in a victim’s browser.
- Affected Systems: BA Book Everything up to 1.8.27.
- Immediate Action: Review public booking forms and block suspicious guest submissions.
- Mitigation: Upgrade and escape booking fields on output.
CVE-2026-93303: HT Contact Form draft-resume XSS
- Impact: Attackers can store script in draft-resume data and trigger it via a crafted URL.
- Affected Systems: HT Contact Form up to 2.10.1.
- Immediate Action: Treat draft resume links as untrusted and invalidate exposed tokens.
- Mitigation: Upgrade and sanitize rich text fields before save and render.
CVE-2026-84280: Fancy Product Designer order-title XSS
- Impact: Stored JSON order data can execute script in the admin panel.
- Affected Systems: Fancy Product Designer up to 6.5.2.
- Immediate Action: Restrict order review access and inspect recent order metadata.
- Mitigation: Patch and stop rendering stored titles via innerHTML.
CVE-2026-93654: Premium Packages invoice XSS
- Impact: Unauthenticated attackers can plant script that renders to logged-in users viewing invoices.
- Affected Systems: Premium Packages up to 7.2.1.
- Immediate Action: Disable public checkout routes until patched.
- Mitigation: Update and enforce order ownership checks.
CVE-2026-61815: mail-mime-parser CRLF injection
- Impact: Attackers can inject mail headers such as Bcc through crafted filenames.
- Affected Systems: zbateson/mail-mime-parser versions before the fixed release.
- Immediate Action: Strip CR/LF from attachment filenames immediately.
- Mitigation: Upgrade and validate filenames on both parse and send paths.
CVE-2026-96568: Restaurant Menu and Food Ordering XSS
- Impact: Unauthenticated attackers can inject script through phone-number fields.
- Affected Systems: WordPress plugin up to 2.4.14.
- Immediate Action: Review public order forms and sanitize stored customer data.
- Mitigation: Upgrade and escape phone fields when displayed.
CVE-2026-95866: User Profile Builder avatar XSS
- Impact: Raw avatar values can be stored and later rendered as executable content.
- Affected Systems: User Profile Builder up to 4.0.2.
- Immediate Action: Audit profile uploads and disable untrusted avatar updates.
- Mitigation: Upgrade and close the zero-length multipart bypass.
CVE-2026-84281: Fancy Product Designer order-item meta XSS
- Impact: JSON-escaped payloads can become executable when admin views orders.
- Affected Systems: Fancy Product Designer up to 6.5.2.
- Immediate Action: Review unauthenticated order submission activity and block suspicious payloads.
- Mitigation: Patch and validate JSON decode/render boundaries.
CVE-2026-94573: Repeater Fields for Elementor Forms XSS
- Impact: Stored script can execute whenever a user views an injected page.
- Affected Systems: Repeater Fields for Elementor Forms up to 2.2.7.
- Immediate Action: Disable exposed form endpoints if you cannot patch today.
- Mitigation: Upgrade and escape repeater values on output.
CVE-2026-96752: Zero Spam nested POST key XSS
- Impact: Crafted field names can be stored verbatim and later rendered as script.
- Affected Systems: Zero Spam for WordPress up to 5.7.10.
- Immediate Action: Review spam logs for nested array keys containing HTML or JavaScript.
- Mitigation: Upgrade and sanitize submission keys before storage.
CVE-2026-95864: Themify Builder CSS font XSS
- Impact: Attackers can inject script through a front-end nonce-covered endpoint.
- Affected Systems: Themify Builder up to 7.8.1.
- Immediate Action: Treat the exposed nonce as insufficient protection and patch immediately.
- Mitigation: Upgrade and validate all CSS font inputs server-side.
CVE-2026-83591: AMP for WP comment XSS
- Impact: Comment content can be transformed into script-bearing output on AMP pages.
- Affected Systems: AMP for WP up to 1.1.16.
- Immediate Action: Review comment moderation and disable risky AMP transformations if possible.
- Mitigation: Upgrade and block javascript: URLs during sanitization.

Previously Alerted

What to Do Now

Patch the highest-risk internet-facing services first: WordPress plugins, Snipe-IT, ZITADEL, Rsdoctor, Cline, and any XML-parsing services.
Disable or restrict exposed developer and admin services: local dashboards, report servers, and unauthenticated MCP or WebSocket endpoints.
Review logs for abuse: look for suspicious AJAX calls, unusual attachment downloads, XML uploads, and unexpected admin-role changes.
Rotate credentials if exposure is likely: session cookies, API tokens, bootstrap secrets, and developer environment keys.
Verify patch levels: confirm the exact fixed version or commit is deployed, not just downloaded.

Verification steps: inventory all affected products, confirm versions against the advisory ranges, and test whether public endpoints still accept anonymous or cross-origin requests. For WordPress, check plugin inventories site-wide; for developer tools, verify the service is not listening on all interfaces and that Origin checks are enforced.

Monitoring recommendations: alert on sudden role changes, new MCP server entries, unexpected file deletions, abnormal XML or attachment uploads, and outbound connections from build or editor tools. Watch for browser-side XSS indicators in admin sessions and for any local dashboard traffic from non-local origins.

Related Resources

Internal blog posts: related write-ups will be published separately; reference them internally once available.
Official vendor advisories: use the vendor and GitHub security advisories linked in each CVE record above for patch guidance and fixed versions.