2026-08-01 归档

今日共收录 1220 条安全情报，包含 330 个 CVE，503 篇安全通告，以及 110 篇研究论文。

← 返回归档列表

漏洞预警2026-07-31 发布INFO

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing...

CVE-2026-14931

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-31 发布INFO

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users t...

CVE-2026-14930

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-31 发布INFO

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to ove...

CVE-2026-14929

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-31 发布INFO

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allow...

CVE-2026-14928

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning supp

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-31 发布INFO

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a s...

CVE-2026-14927

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership che

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-31 发布INFO

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the p...

CVE-2026-14922

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 throug

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-31 发布INFO

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),

CVE-2026-14921

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-31 发布INFO

The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who obtain the stored...

CVE-2026-14862

The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downlo

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-31 发布INFO

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads director...

CVE-2026-14849

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it

历史摘要 · 未重新核验 · NVD

#cve #cwe-552

漏洞预警2026-07-31 发布INFO

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticat...

CVE-2026-14847

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of i

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-31 发布INFO

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one o...

CVE-2026-14845

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor re

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-31 发布INFO

The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change re...

CVE-2026-14843

The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the target

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-31 发布INFO

The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configur...

CVE-2026-14834

The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-07-31 发布INFO

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, ...

CVE-2026-14833

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rend

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-31 发布INFO

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowi...

CVE-2026-14830

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-31 发布INFO

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privil...

CVE-2026-14554

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-31 发布INFO

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowi...

CVE-2026-14333

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a p

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-07-31 发布INFO

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to re...

CVE-2026-14319

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurri

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-31 发布INFO

The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sani...

CVE-2026-13609

The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value af

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-31 发布INFO

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the ...

CVE-2026-13393

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item

历史摘要 · 未重新核验 · NVD

#cve #cwe-79