BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and...
CVE-2026-86112
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing auth
2026-09-06 归档
今日共收录 918 条安全情报，包含 147 个 CVE，434 篇安全通告，以及 81 篇研究论文。
← 返回归档列表BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough...
CVE-2026-86113
BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authe
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its...
CVE-2026-84926
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST route
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before...
CVE-2026-84021
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTM
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value...
CVE-2026-84898
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape...
CVE-2026-84937
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input be
The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ...
CVE-2026-85414
The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortco
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a...
CVE-2026-84225
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the...
CVE-2026-84745
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all...
CVE-2026-75018
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation...
CVE-2026-81543
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of...
CVE-2026-84901
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management RES
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using...
CVE-2026-84221
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allo
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check...
CVE-2026-84927
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Rev
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several...
CVE-2026-84022
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before out
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross...
CVE-2026-76573
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_fo
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public...
CVE-2026-84936
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allo
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting...
CVE-2026-83625
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in
The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation...
CVE-2026-83544
The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it
The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL...
CVE-2026-81423
The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redi