First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-81298

HighCVSS 7.1/10Last modified Sep 1, 2026

Description

Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
varunvairavanlc	LeadConnector	<= 4.0.5

References

https://patchstack.com/database/wordpress/plugin/leadconnector/vulnerability/wordpress-leadconnector-plugin-4-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve

Timeline

Published: Aug 31, 2026
Last modified: Sep 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-812994.3Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.CVE-2026-81307.3A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. This affects an unknown function of the file /admin/message.php. T CVE-2026-813007.1Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.CVE-2026-813018.5Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller CVE-2026-813028.5PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code wi CVE-2026-813036.3A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spe CVE-2026-813056.8CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An atta CVE-2026-81317.3A security flaw has been discovered in SourceCodester SUP Online Shopping 1.0. This impacts an unknown function of the file /admin/replymsg.CVE-2026-813106.6Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is in CVE-2026-813157.4Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection CVE-2026-813162.1Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restric CVE-2026-813182.1Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate

CVE-2026-81298: High severity, CVSS 7.1 | Vulnix