DOM-based XSS in playground.wordpress.net (/scope:*/wp-includes/empty.html) lets any attacker run JavaScript on the origin via a single crafted link

Bug reported by Antonio Rivera Poblete was disclosed at November 11, 2026, 8:13 pm   |   Cross-site Scripting (XSS) - DOM

A DOM-based cross-site scripting vulnerability was discovered in a WordPress playground environment. The vulnerability was located in the service worker code that intercepted requests to a specific file path. The vulnerable code retrieved an attacker-controlled URL fragment and passed it through URL decoding before writing it directly into the page using an unsafe DOM method without any content security policy protection. This allowed arbitrary JavaScript to be executed in the origin's context. The vulnerability was confirmed to enable data exfiltration of cookies and local storage contents to external servers. No authentication was required for exploitation, and the payload was entirely contained within the URL fragment, making it invisible to server logs.

CSRF in tracker invocation page

Bug reported by Abhishek Bhaskar was disclosed at November 11, 2026, 10:49 am   |   Cross-Site Request Forgery (CSRF)

Cross-agency delivery rule set creation

Bug reported by Dang Hung Vi was disclosed at November 11, 2026, 10:49 am   |   Insecure Direct Object Reference (IDOR)

Cross-agency disclosure in website listing

Bug reported by Shmulik Cohen was disclosed at November 11, 2026, 10:48 am   |   Insecure Direct Object Reference (IDOR)

Reflected XSS via invocation banner ID field in admin-generate.php

Bug reported by was disclosed at November 11, 2026, 10:48 am   |   Cross-site Scripting (XSS) - Reflected

Formula injection in conversion tracking report export

Bug reported by BapToutatis was disclosed at November 11, 2026, 10:48 am   |   Code Injection

Stored XSS via unescaped tracker name in append-code check

Bug reported by Elias was disclosed at November 11, 2026, 10:48 am   |   Cross-site Scripting (XSS) - Stored

Reflected XSS via wrong permission check in conversion statistics

Bug reported by Patrick was disclosed at November 11, 2026, 10:47 am   |   Cross-site Scripting (XSS) - Reflected

Reflected XSS in popup invocation options

Bug reported by was disclosed at November 11, 2026, 10:46 am   |   Cross-site Scripting (XSS) - Reflected

A reflected cross-site scripting vulnerability was found in popup invocation options. Request parameters for top, left, timeout, and delay were included in HTML attributes without proper encoding. Popup option values were subsequently HTML-encoded when included in invocation-option form fields to resolve the issue.

Missing campaign ownership check in zone bulk linking

Bug reported by was disclosed at November 11, 2026, 10:46 am   |   Insecure Direct Object Reference (IDOR)

A missing campaign ownership check was identified in the bulk-linking operation of a zone management file. The single-link operation and XML-RPC API were also affected by this issue. An authorized user with zone-linking permissions could associate another agency's campaign with their own zone. The unauthorized association could expose the foreign campaign's name, type and identifier in the linked-campaign listing. Campaign ownership validation was added to the bulk-linking and single-link operations and in the XML-RPC campaign-linking method to resolve this issue.

Stored XSS in report date selection

Bug reported by Matias Lopez was disclosed at November 11, 2026, 10:46 am   |   Cross-site Scripting (XSS) - Stored

A stored cross-site scripting vulnerability was discovered in the date-selection controls of standard reports. A crafted period preset value could be saved in a user's session and inserted into JavaScript without proper encoding, allowing malicious code to execute during report views. The vulnerability was resolved by implementing JSON encoding for date-selection values in their JavaScript context, with the same encoding applied to audit date-selection fields.

Unauthenticated reflected XSS in update history

Bug reported by Matias Lopez was disclosed at November 11, 2026, 10:46 am   |   Cross-site Scripting (XSS) - Reflected

A reflected cross-site scripting vulnerability was found in the update history functionality. Attacker-controlled values were included in XML command attributes without proper encoding, allowing malicious input to inject executable code into responses. The vulnerability was accessible without authentication through GET requests, and authenticated administrators could also be affected. The issue was resolved by applying session validation to both GET and POST requests and encoding XML attribute values in response serializers.

Reflected XSS via invocation iFrame size fields

Bug reported by Adam Rayyan was disclosed at November 11, 2026, 10:46 am   |   Cross-site Scripting (XSS) - Reflected

A reflected cross-site scripting vulnerability was discovered in iframe invocation options. The frame width and height parameters were included in HTML attributes without proper encoding when generating invocation tags for any-size zones. This vulnerability was resolved by implementing HTML encoding for width and height values in invocation-option form fields.

Access control bypass due to request precedence issue in global input registration

Bug reported by Kush Bafti was disclosed at November 11, 2026, 10:43 am   |   Insecure Direct Object Reference (IDOR)

Blind SQL injection due to request precedence issue in global input registration

Bug reported by Sh4d0byss was disclosed at November 11, 2026, 10:37 am   |   SQL Injection

A blind SQL injection vulnerability was discovered in administration pages for banner zones and campaign zones. The vulnerability resulted from a request precedence issue where permission checks and database queries used different values for the same request parameter. This mismatch could have been exploited by a restricted manager to extract arbitrary database values, including password hashes and session identifiers. The issue was resolved by standardizing input handling to ensure both permission checks and database queries read from the same request sources in a consistent order.

Unauthenticated attacker can book appointments at arbitrary times, including outside availability and in the past

Bug reported by mazen was disclosed at November 11, 2026, 12:50 am   |   Business Logic Errors

A vulnerability was discovered in the Calendar application's public appointment booking endpoint. The endpoint validated that a bookable slot existed within a requested time range, but then persisted the attacker-supplied start and end times instead of the validated slot values. This allowed unauthenticated attackers with access to the public booking link to create confirmed events on an organizer's calendar at arbitrary times, including outside configured availability windows, on unavailable days, in the past, and bypassing daily booking limits and conflict checks. The flaw was fixed by requiring the requested time to match an available slot exactly.