CVE-2026-108151

MediumCVSS 5.3/10Last modified Oct 15, 2026

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
PluginUs.NetMDTF<= 1.3.9

References

Timeline

Published
Oct 14, 2026
Last modified
Oct 15, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1081567.1LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts tCVE-2026-1081578.1Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to CVE-2026-1081586.5plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting particiCVE-2026-1081597.5AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackCVE-2026-108167.5Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with managCVE-2026-1081607.5AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver maliciousCVE-2026-1081617.5FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers CVE-2026-1081626.5Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttCVE-2026-1081636.5Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are inteCVE-2026-1081646.5Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_coCVE-2026-1081654.3Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partnersCVE-2026-108167The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when fil