今日共收录 1881 条安全情报，包含 959 个 CVE，493 篇安全通告，以及 113 篇研究论文。
← 返回归档列表CVE-2026-18943
The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allow
CVE-2026-18789
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality,
CVE-2026-18474
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL sta
CVE-2026-18230
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL sta
CVE-2026-18057
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it i
CVE-2026-18049
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its
CVE-2026-18048
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a f
CVE-2026-18046
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability
CVE-2026-18035
The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allo
CVE-2026-17013
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it
CVE-2026-16977
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is
CVE-2026-16737
The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a ca
CVE-2026-16294
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode
CVE-2026-16253
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-resto
CVE-2026-16066
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it
CVE-2026-15388
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability
CVE-2026-15249
The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts i
CVE-2026-14925
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file downlo
CVE-2026-14859
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX a
CVE-2026-14858
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowi