2026-09-17 归档

今日共收录 2425 条安全情报，包含 1381 个 CVE，651 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-09-16 发布INFO

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed...

CVE-2026-84907

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) paym

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above ...

CVE-2026-84905

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to in...

CVE-2026-84829

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript naviga...

CVE-2026-84088

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link s

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowi...

CVE-2026-82126

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content...

CVE-2026-82125

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the mo

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it...

CVE-2026-82124

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protect

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthen...

CVE-2026-78474

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to per...

CVE-2026-78472

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthen...

CVE-2026-77702

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capabil...

CVE-2026-76559

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during t

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administ...

CVE-2026-76558

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing use...

CVE-2026-76557

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users hold...

CVE-2026-76556

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allow...

CVE-2026-76555

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it a

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to,...

CVE-2026-76553

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing ...

CVE-2026-76552

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it re

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permissi...

CVE-2026-76551

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to...

CVE-2026-76550

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing expo

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-16 发布INFO

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, su...

CVE-2026-74926

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of

历史摘要 · 未重新核验 · NVD

#cve