今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-79995
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email c
CVE-2026-79706
The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to buil
CVE-2026-79615
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question ba
CVE-2026-78238
SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of th
CVE-2026-77838
SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of th
CVE-2026-77701
The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns t
CVE-2026-73827
SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of th
CVE-2026-6286
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Script
CVE-2026-4246
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advan
CVE-2026-19423
The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve
CVE-2026-19084
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured im
CVE-2026-14567
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowi
CVE-2026-14558
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises use
CVE-2026-12514
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capab
CVE-2026-12513
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly saniti
CVE-2026-82090
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alt
CVE-2026-82089
The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries da
CVE-2026-82081
wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.
CVE-2026-77365
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vuln
CVE-2026-76053
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross