2026-08-17 归档

今日共收录 803 条安全情报，包含 111 个 CVE，370 篇安全通告，以及 71 篇研究论文。

← 返回归档列表

漏洞预警2026-08-16 发布INFO

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to sto...

CVE-2026-19712

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-16 发布INFO

The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, ...

CVE-2026-19711

The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-16 发布INFO

The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supp...

CVE-2026-19613

The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeate

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-16 发布INFO

The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection ...

CVE-2026-18653

The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL sta

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-16 发布INFO

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute in a...

CVE-2026-18402

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting v

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-16 发布INFO

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data...

CVE-2026-17582

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-16 发布INFO

The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and includin...

CVE-2026-17581

The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'the

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-08-16 发布INFO

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, a...

CVE-2026-17533

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionalit

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-16 发布INFO

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all vers...

CVE-2026-16775

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cros

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-16 发布INFO

The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient...

CVE-2026-16758

The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-16 发布INFO

The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode. This is due to in...

CVE-2026-15790

The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-16 发布INFO

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series_bg_color' post meta field. This i...

CVE-2026-15604

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includin

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-16 发布INFO

The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its...

CVE-2026-15384

The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the au

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-16 发布INFO

The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all ...

CVE-2026-15351

The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-16 发布INFO

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. Thi...

CVE-2026-15345

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-16 发布INFO

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and...

CVE-2026-15056

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vul

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-16 发布INFO

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a r...

CVE-2026-13712

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before ou

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-08-16 发布INFO

The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input ...

CVE-2026-10035

The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-08-16 发布INFO

A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the function gets of the component Customer Search Module. This m...

CVE-2026-19933

A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the func

历史摘要 · 未重新核验 · NVD

#cve #cwe-119 #cwe-121

漏洞预警2026-08-16 发布INFO

A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component Noti...

CVE-2026-19932

A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function Groovy

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-94