Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps DevItems/HashBar – WordPress Notification Bar (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for DevItems/HashBar – WordPress Notification Bar.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Aug 18, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 18, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 18, 2026

Sources and claim methodology

• Source referencepatchstack.com

Related CVEs

• Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery ProtectionAlso CWE-352
• PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password ExposureSame generic ecosystem
• Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernelSame generic ecosystem
• Out-of-bounds read in Zephyr PTP message parsing from unvalidated message typeSame generic ecosystem
• Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C200Same generic ecosystem
• Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200Same generic ecosystem

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps DevItems/HashBar – WordPress Notification Bar (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for DevItems/HashBar – WordPress Notification Bar.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Aug 18, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 18, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 18, 2026

Sources and claim methodology

• Source referencepatchstack.com

Related CVEs

• Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery ProtectionAlso CWE-352
• PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password ExposureSame generic ecosystem
• Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernelSame generic ecosystem
• Out-of-bounds read in Zephyr PTP message parsing from unvalidated message typeSame generic ecosystem
• Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C200Same generic ecosystem
• Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200Same generic ecosystem