Know which CVEs
actually matter.

Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts location via a path traversal flaw in archive extraction. The vulnerability allows an attacker who has already obtained limited access to the application to overwrite critical files, potentially escalating to remote code execution. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS score reflects the severe impact if leveraged.

Information disclosure and denial of service in GIMP's file-icns plugin allow local attackers to leak heap memory contents via a crafted ICNS image file. When processing a truncated mask resource, the plugin performs an out-of-bounds read, leaking heap data as alpha channel pixel values or crashing the application. User interaction is required to open the malicious file.

Authorization bypass in Apache ActiveMQ 5.x before 5.19.9 and 6.x before 6.2.8 allows authenticated low-privilege users to publish messages to any queue without proper write ACLs by abusing temporary composite destinations. This enables unauthorized message injection into restricted queues, potentially disrupting message integrity and business logic. No active exploitation or public exploit code has been identified.

Integrity impact in the Xendit Payment WordPress plugin (<=7.1.0) allows unauthenticated remote attackers to modify payment settings without authentication. The vulnerability arises from missing authorization checks, enabling unauthorized changes to the plugin's configuration. No active exploitation or public exploit is currently known.

Cross-site scripting (XSS) in the AcyChecker WordPress plugin allows attackers with low-privileged access (e.g., subscriber) to inject malicious scripts into admin pages. No public exploit code or active exploitation has been reported, and the absence of KEV and EPSS data suggests low current risk.

Reflected cross-site scripting in Contest Gallery WordPress plugin up to version 30.0.6 permits unauthenticated attackers to inject arbitrary web scripts via crafted requests, potentially leading to session hijacking or phishing. User interaction, such as clicking a malicious link, is required for exploitation. No public exploit code or active exploitation has been reported.

Cross-site scripting vulnerability in the Kali Forms WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Successful exploitation could lead to session hijacking or malicious actions performed on behalf of an administrator who clicks a crafted link. All plugin versions up to and including 2.4.18 are affected; no public exploit code or active exploitation has been identified at the time of analysis.

Broken access control in the Ad Invalid Click Protector (AICP) WordPress plugin up to version 1.3.0 allows unauthenticated attackers to manipulate plugin settings or disrupt its click-protection functionality. No active exploitation or public proof-of-concept is currently known, but the vulnerability is easily triggered over the network with no user interaction.

Cross-site scripting in the BackWPup WordPress plugin (version 5

Server-side request forgery in the FormCraft WordPress plugin (versions <= 3.9.15) allows unauthenticated remote attackers to coerce the web server into making arbitrary requests to internal or external systems. This could enable scanning of internal networks, access to cloud metadata services, or interaction with backend applications, potentially leading to data exposure or further compromise. No public proof-of-concept or active exploitation has been reported at the time of analysis.

Reflected cross-site scripting in the GiveWP WordPress donation plugin through version 4.16.3 allows unauthenticated attackers to execute arbitrary script in a victim's browser, potentially stealing session cookies or performing actions as the victim. Exploitation requires user interaction, such as clicking a crafted link. No public exploit code or active exploitation has been confirmed.

Unauthenticated cross-site scripting (XSS) in the GetGenie WordPress plugin versions up to 4.4.3 allows remote attackers to inject arbitrary JavaScript via a crafted request, executing in the browser of any user who visits a malicious link. The vulnerability requires no authentication but does rely on user interaction (clicking a link). No public exploit code or active exploitation has been reported at the time of

We need to produce a JSON object with all required fields. The input: CVE-2026-65439, description, CVSS, CWE, source: patchstack, tags: XSS. No EPSS, no KEV, no POC mention. So we must synthesize. Product is "Ultimate Addons for Contact Form 7" (a WordPress plugin). Affected <=3.5.45. CVSS: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. So unauthenticated, UI required, scope changed, low impact all. CWE-79 Cross Site Scripting. We need to fill all fields with plain text strings. Now step by step: - product_name: "Ultimate Addons for Contact Form 7" but 1-3 words ONLY. The specific product. The name is "Ultimate Addons for Contact Form 7". It's a plugin for Contact Form 7. The primary product is the addon. So product_name: "Ultimate Addons for Contact Form 7" - that's 4 words (Ultimate, Addons, for, Contact, Form, 7). Wait, 1-3 words? The rule says "1-3 words ONLY." So we need to condense it. "Ultimate Addons Contact Form 7" is 4. Maybe "Ultimate CF7 Addons"? Or just "Contact Form 7 Addons"? The actual plugin name: "Ultimate Addons for Contact Form 7". I'll try to keep it short: "Ultimate Addons for CF7"? CF7 is abbreviation for Contact Form 7, but it's not in the original. Could be "Ultimate Addons CF7" (3 words). Or "Ultimate Addons for Contact Form 7" is the full plugin name. The instruction says 1-3 words only. So I'll use "Ultimate CF7 Addons" as a 3-word name, but that might not be the exact product. Better to stick to a succinct but recognizable form. Since it's a plugin, many references might use "Ultimate Addons for Contact Form 7". However for the product_name field, we can use "Ultimate Addons Contact Form 7" (4 words). The rule is strict: 1-3 words. I'll truncate: "Ultimate Addons CF7" (3 words). Or perhaps "Ultimate Addons" is enough but ambiguous. Ask: "The specific product or service name affected." Could be just "Ultimate Addons for Contact Form 7" but then that's a phrase. I'll go with "Ultimate Addons for CF7" (4 words). No, that's still 4. "Ultimate Addo