2026-09-06 归档

今日共收录 918 条安全情报，包含 147 个 CVE，434 篇安全通告，以及 81 篇研究论文。

← 返回归档列表

漏洞预警2026-09-05 发布INFO

The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated...

CVE-2026-78149

The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its c

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-05 发布INFO

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all version...

CVE-2026-77830

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-05 发布INFO

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing...

CVE-2026-77826

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was iss

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-05 发布INFO

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `et_pb_set_video_oembed_thumbnail_reso...

CVE-2026-4361

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6.

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-05 发布INFO

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up t...

CVE-2026-3853

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-05 发布INFO

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Tele...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-09-05 发布INFO

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notif...

CVE-2026-19861

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-05 发布INFO

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering,...

CVE-2026-19858

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks w

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-05 发布INFO

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatche...

CVE-2026-19769

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site S

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-05 发布INFO

The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter in all versions ...

CVE-2026-18843

The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-05 发布INFO

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Paylo...

CVE-2026-18406

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-05 发布INFO

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient in...

CVE-2026-16649

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all ver

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-05 发布INFO

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input...

CVE-2026-15984

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versio

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-05 发布INFO

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allo...

CVE-2026-15247

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a se

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-05 发布INFO

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible ...

CVE-2026-14975

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-05 发布INFO

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privil...

CVE-2025-15694

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before output

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-05 发布INFO

The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allo...

CVE-2025-15693

The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its admini

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-05 发布INFO

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (Custom HTML block i...

CVE-2026-8625

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-05 发布INFO

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (class attribute of ...

CVE-2026-8623

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-05 发布INFO

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though...

CVE-2026-86145

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursiv

历史摘要 · 未重新核验 · NVD

#cve #cwe-424