今日共收录 1886 条安全情报，包含 1062 个 CVE，406 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-18777
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allo
CVE-2026-18466
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX
CVE-2026-18231
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX ac
CVE-2026-18202
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising t
CVE-2026-17565
The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using i
CVE-2026-16979
The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on tw
CVE-2026-16950
The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it i
CVE-2026-16617
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before o
CVE-2026-16616
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachabl
CVE-2026-16570
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string para
CVE-2026-15253
The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting
CVE-2026-14861
The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verifica
CVE-2026-14826
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the RE
CVE-2026-14825
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before sa
CVE-2026-14334
The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG
CVE-2026-14287
The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated requ
CVE-2026-14196
The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allow
CVE-2026-13175
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or
CVE-2026-13174
The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allow
CVE-2026-13173
The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before ass