resolved
DOM-based XSS in playground.wordpress.net (/scope:*/wp-includes/empty.html) lets any attacker run JavaScript on the origin via a single crafted link
Bug reported by Antonio Rivera Poblete was disclosed at November 11, 2026, 8:13 pm | Cross-site Scripting (XSS) - DOM
A DOM-based cross-site scripting vulnerability was discovered in a WordPress playground environment. The vulnerability was located in the service worker code that intercepted requests to a specific file path. The vulnerable code retrieved an attacker-controlled URL fragment and passed it through URL decoding before writing it directly into the page using an unsafe DOM method without any content security policy protection. This allowed arbitrary JavaScript to be executed in the origin's context. The vulnerability was confirmed to enable data exfiltration of cookies and local storage contents to external servers. No authentication was required for exploitation, and the payload was entirely contained within the URL fragment, making it invisible to server logs.
resolved
CSRF in tracker invocation page
Bug reported by Abhishek Bhaskar was disclosed at November 11, 2026, 10:49 am | Cross-Site Request Forgery (CSRF)
resolved
Cross-agency delivery rule set creation
Bug reported by Dang Hung Vi was disclosed at November 11, 2026, 10:49 am | Insecure Direct Object Reference (IDOR)
resolved
Cross-agency disclosure in website listing
Bug reported by Shmulik Cohen was disclosed at November 11, 2026, 10:48 am | Insecure Direct Object Reference (IDOR)
resolved
Reflected XSS via invocation banner ID field in admin-generate.php
Bug reported by was disclosed at November 11, 2026, 10:48 am | Cross-site Scripting (XSS) - Reflected
resolved
Formula injection in conversion tracking report export
Bug reported by BapToutatis was disclosed at November 11, 2026, 10:48 am | Code Injection
resolved
Stored XSS via unescaped tracker name in append-code check
Bug reported by Elias was disclosed at November 11, 2026, 10:48 am | Cross-site Scripting (XSS) - Stored
resolved
Reflected XSS via wrong permission check in conversion statistics
Bug reported by Patrick was disclosed at November 11, 2026, 10:47 am | Cross-site Scripting (XSS) - Reflected
resolved
Reflected XSS in popup invocation options
Bug reported by was disclosed at November 11, 2026, 10:46 am | Cross-site Scripting (XSS) - Reflected
A reflected cross-site scripting vulnerability was found in popup invocation options. Request parameters for top, left, timeout, and delay were included in HTML attributes without proper encoding. Popup option values were subsequently HTML-encoded when included in invocation-option form fields to resolve the issue.
resolved
Missing campaign ownership check in zone bulk linking
Bug reported by was disclosed at November 11, 2026, 10:46 am | Insecure Direct Object Reference (IDOR)
A missing campaign ownership check was identified in the bulk-linking operation of a zone management file. The single-link operation and XML-RPC API were also affected by this issue. An authorized user with zone-linking permissions could associate another agency's campaign with their own zone. The unauthorized association could expose the foreign campaign's name, type and identifier in the linked-campaign listing. Campaign ownership validation was added to the bulk-linking and single-link operations and in the XML-RPC campaign-linking method to resolve this issue.
resolved
Stored XSS in report date selection
Bug reported by Matias Lopez was disclosed at November 11, 2026, 10:46 am | Cross-site Scripting (XSS) - Stored
A stored cross-site scripting vulnerability was discovered in the date-selection controls of standard reports. A crafted period preset value could be saved in a user's session and inserted into JavaScript without proper encoding, allowing malicious code to execute during report views. The vulnerability was resolved by implementing JSON encoding for date-selection values in their JavaScript context, with the same encoding applied to audit date-selection fields.
resolved
Unauthenticated reflected XSS in update history
Bug reported by Matias Lopez was disclosed at November 11, 2026, 10:46 am | Cross-site Scripting (XSS) - Reflected
A reflected cross-site scripting vulnerability was found in the update history functionality. Attacker-controlled values were included in XML command attributes without proper encoding, allowing malicious input to inject executable code into responses. The vulnerability was accessible without authentication through GET requests, and authenticated administrators could also be affected. The issue was resolved by applying session validation to both GET and POST requests and encoding XML attribute values in response serializers.
resolved
Reflected XSS via invocation iFrame size fields
Bug reported by Adam Rayyan was disclosed at November 11, 2026, 10:46 am | Cross-site Scripting (XSS) - Reflected
A reflected cross-site scripting vulnerability was discovered in iframe invocation options. The frame width and height parameters were included in HTML attributes without proper encoding when generating invocation tags for any-size zones. This vulnerability was resolved by implementing HTML encoding for width and height values in invocation-option form fields.
resolved
Access control bypass due to request precedence issue in global input registration
Bug reported by Kush Bafti was disclosed at November 11, 2026, 10:43 am | Insecure Direct Object Reference (IDOR)
resolved
Blind SQL injection due to request precedence issue in global input registration
Bug reported by Sh4d0byss was disclosed at November 11, 2026, 10:37 am | SQL Injection
A blind SQL injection vulnerability was discovered in administration pages for banner zones and campaign zones. The vulnerability resulted from a request precedence issue where permission checks and database queries used different values for the same request parameter. This mismatch could have been exploited by a restricted manager to extract arbitrary database values, including password hashes and session identifiers. The issue was resolved by standardizing input handling to ensure both permission checks and database queries read from the same request sources in a consistent order.
resolved
Unauthenticated attacker can book appointments at arbitrary times, including outside availability and in the past
Bug reported by mazen was disclosed at November 11, 2026, 12:50 am | Business Logic Errors
A vulnerability was discovered in the Calendar application's public appointment booking endpoint. The endpoint validated that a bookable slot existed within a requested time range, but then persisted the attacker-supplied start and end times instead of the validated slot values. This allowed unauthenticated attackers with access to the public booking link to create confirmed events on an organizer's calendar at arbitrary times, including outside configured availability windows, on unavailable days, in the past, and bypassing daily booking limits and conflict checks. The flaw was fixed by requiring the requested time to match an available slot exactly.
![[Image: e72398fe92beda2aa80d0329e8b9f4febece7568.gif]](https://64.media.tumblr.com/834502d05f9b014cbc37366fe428a5a7/13cb9841c0799d7a-ff/s500x560/e72398fe92beda2aa80d0329e8b9f4febece7568.gif)
