2026-09-17 归档

今日共收录 2425 条安全情报，包含 1381 个 CVE，651 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-09-16 发布INFO

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded me...

CVE-2026-88910

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauth

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level ...

CVE-2026-87959

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing u...

CVE-2026-87907

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints tha

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records, allowing unauthen...

CVE-2026-87896

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logge...

CVE-2026-87860

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that c

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated user...

CVE-2026-87854

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as sub...

CVE-2026-87828

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-upda

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers ...

CVE-2026-86823

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users...

CVE-2026-86784

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration befo

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unaut...

CVE-2026-86449

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied pos

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing un...

CVE-2026-86448

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serv

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every ...

CVE-2026-86447

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrie...

CVE-2026-86445

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative templa

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to ...

CVE-2026-86444

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when...

CVE-2026-85641

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user las

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, s...

CVE-2026-85572

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its less

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recor...

CVE-2026-85569

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to it

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor ...

CVE-2026-85530

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, inc...

CVE-2026-85349

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of board

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restri...

CVE-2026-85131

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk a

历史摘要 · 未重新核验 · NVD

#cve