Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.
CVE-2026-39594
Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.
2026-06-16 归档
今日共收录 1237 条安全情报，包含 420 个 CVE，450 篇安全通告，以及 98 篇研究论文。
← 返回归档列表Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.
CVE-2026-39587
Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.
Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.
CVE-2026-39584
Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.
Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.
CVE-2026-39579
Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.
Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.
CVE-2026-39540
Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.
Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.
CVE-2026-39534
Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.
Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions.
CVE-2026-39533
Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions.
Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.
CVE-2026-39532
Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.
Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.
CVE-2026-39527
Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.
Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.
CVE-2026-39525
Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.
Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.
CVE-2026-39524
Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.
Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.
CVE-2026-39518
Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.
Subscriber Broken Access Control in Motors < 1.4.107 versions.
CVE-2026-39515
Subscriber Broken Access Control in Motors < 1.4.107 versions.
Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.
CVE-2026-39514
Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.
Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.
CVE-2026-39513
Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.
Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.
CVE-2026-39507
Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.
Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.
CVE-2026-39503
Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.
Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.
CVE-2026-39499
Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.
Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.
CVE-2026-39498
Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
CVE-2026-39491
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.