🕵️ RESEARCH & DEEP DIVES
Advanced Popups WordPress plugin through 1.2.3 vulnerable to stored XSS (CVE-2026-11996)
The Advanced Popups WordPress plugin versions up to and including 1.2.3 contain a stored cross-site scripting vulnerability.- Affects WordPress sites running the Advanced Popups plugin, all versions up to and including 1.2.3.
- Stored XSS via the 'Notification Button Link' field, caused by insufficient input sanitization and output escaping (CWE-79).
- Authenticated attackers with author-level access or higher can inject arbitrary web scripts into pages.
- Injected scripts execute whenever a user accesses an affected page; CVSS 3.1 score of 6.4 (Medium).
- Discovered 2026-04-02, vendor notified 2026-06-19, disclosed 2026-09-15; credited to Nguyen Cong Quang.
WP-Lister Lite for eBay through 3.8.9 hit by unauthenticated stored XSS (CVE-2026-18595)
The WP-Lister Lite for eBay WordPress plugin is vulnerable to unauthenticated stored cross-site scripting in all versions up to and including 3.8.9.- Affects WordPress sites running WP-Lister Lite for eBay in all versions up to and including 3.8.9.
- Stored XSS via the AJAX Cron Handler request parameter, caused by insufficient input sanitization and output escaping (CWE-79).
- Unauthenticated attackers can inject arbitrary web scripts into pages that execute whenever a user views an injected page.
- CVSS 3.1 score of 7.2 (High); discovered 2026-05-25, vendor notified 2026-08-02, disclosed 2026-09-15; credited to thevietronin.
SQL injection found in gedelumbung HospitalManagement generate_index_pasien (CVE-2026-92221)
A SQL injection vulnerability has been disclosed in the gedelumbung HospitalManagement project's admin patient model.- Affects gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8; the project uses rolling releases, so no fixed version is available.
- The generate_index_pasien function in application/models/app_global_admin_model.php is vulnerable via manipulation of the 'cari' argument.
- The flaw is remotely exploitable SQL injection; the exploit has been publicly disclosed via a GitHub issue report.
- The project was notified early through an issue report but has not yet responded.
- CVSS 3.1 severity is medium (4.7), with high privileges required; reporter credit goes to kaizhi_shawn via VulDB.
Researchers demonstrate homomorphic encrypted inference on a genomic foundation model
Researchers showed that a genomic foundation model can run entirely on encrypted inputs using a client-assisted homomorphic encryption protocol.- Applies to organizations serving genomic foundation models and owners of sensitive human genomic sequence data, which can identify individuals and cannot be replaced once disclosed.
- The study tests whether a compute provider can execute a released genomic model without ever receiving query-derived genomic values in plaintext.
- The protocol is client-assisted: the provider evaluates linear algebra on ciphertexts, while the key-holding data owner computes exact normalization, causal softmax, and activation functions at fixed boundaries.
- The client-assisted configuration completed all released transformer blocks and the task head for one heldout genomic-signal input, matching the frozen reference label.
- Performance: peak 9,839 MiB accelerator memory and 6,683 seconds on one accelerator; repeatability, network transport, and private token-index lookup remain unresolved.
RuleAutoPilot: agentic LLM framework generates deployable Suricata IDS rules from malware traffic
Researchers introduced RuleAutoPilot, an agentic framework that automatically synthesizes deployable Suricata intrusion detection rules directly from malware network traffic.- Applies to teams using rule-based IDS like Suricata, where writing detection rules requires deep expertise and lags emerging threats
- Generates rules from raw malware PCAPs with no prior threat intelligence, using a Benign Traffic Fingerprinting stage to strip background noise before LLM processing
- Rules failing syntax checks, missing the source traffic, or triggering false positives are auto-repaired via structured feedback
- Across 1,296 malware PCAPs, execution-grounded verification raised rule F1 from 0.443 to 0.539
- On gpt-oss-120b it reached 0.524 F1 at 52x lower token cost than Claude Code; with Claude Opus 5 it hit 0.656 F1 vs 0.623 at 40x fewer tokens
Study finds usability barriers in cryptographic verification tools Tamarin and ProVerif
Researchers published an exploratory human-centered study of how experienced users interact with cryptographic protocol verification tools.- Applies to users of cryptographic protocol verifiers, including Tamarin and ProVerif, surveyed across researchers, graduate students, and practitioners.
- Study identified usability barriers across the verification workflow, including debugging non-termination and performance issues and lack of systematic methods for validating formal models against real protocols.
- When proofs fail without concrete attacks, users commonly simplify models, add helper lemmas, and revisit modeling abstractions.
- Participants called for actionable diagnostics, clearer explanations of results, visualization, and automation for recurring proof tasks.
- Authors attribute persistent challenges to the gap between protocol-level reasoning and the verifier's formal model, proof procedures, and diagnostic output.