今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-89138
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.
CVE-2026-88994
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a
CVE-2026-86800
The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before
CVE-2026-84909
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scri
CVE-2026-79713
The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-
CVE-2026-75017
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plu
CVE-2026-75016
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's client
CVE-2026-18317
The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to a
CVE-2026-17576
The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to,
CVE-2026-12106
The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to,
CVE-2024-38639
An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the
CVE-2024-27123
A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit t
CVE-2026-93485
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPre
CVE-2026-90984
The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch
CVE-2026-90978
The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonc
CVE-2026-89008
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on o
CVE-2026-89007
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one o
CVE-2026-88993
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it
CVE-2026-88844
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the c
CVE-2026-88825
The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowin