今日共收录 946 条安全情报，包含 146 个 CVE，466 篇安全通告，以及 75 篇研究论文。
← 返回归档列表CVE-2026-15649
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Sho
CVE-2026-15645
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'na
CVE-2026-15644
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'st
CVE-2026-15601
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zi
CVE-2026-15450
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path trav
CVE-2026-15052
The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cr
CVE-2026-15018
The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algor
CVE-2026-13458
The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML A
CVE-2026-11995
The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress
CVE-2026-10782
The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin
CVE-2025-14073
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecur
CVE-2026-2916
The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an
CVE-2026-15988
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request F
CVE-2025-14469
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,
CVE-2026-15932
The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download
CVE-2026-15368
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after use
CVE-2026-15262
The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before out
CVE-2026-15244
The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before con
CVE-2026-15234
The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before usin
CVE-2026-14840
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts clien