2026-09-24 归档

今日共收录 1600 条安全情报，包含 683 个 CVE，518 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-09-23 发布INFO

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds anot...

CVE-2026-90951

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment action

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-23 发布INFO

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to ...

CVE-2026-89331

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-23 发布INFO

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing ...

CVE-2026-88997

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it i

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-23 发布INFO

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenti...

CVE-2026-88929

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a produc

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-23 发布INFO

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attacke...

CVE-2026-87979

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-23 发布INFO

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and ...

CVE-2026-87074

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who cre

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-23 发布INFO

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the const...

CVE-2026-87069

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before ru

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-23 发布INFO

The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level...

CVE-2026-86842

The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flip

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-23 发布INFO

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update...

CVE-2026-86785

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its RES

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-23 发布INFO

The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys ...

CVE-2026-86783

The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility chec

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-23 发布INFO

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenti...

CVE-2026-86608

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-23 发布INFO

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to re...

CVE-2026-86603

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, all

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-23 发布INFO

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to re...

CVE-2026-86602

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, all

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-23 发布INFO

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing ...

CVE-2026-85006

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-23 发布INFO

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege rol...

CVE-2026-84743

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its R

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-23 发布INFO

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users ...

CVE-2026-84742

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before crea

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-23 发布INFO

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowi...

CVE-2026-84741

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding the

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-23 发布INFO

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through...

CVE-2026-84168

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthen

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-23 发布INFO

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenti...

CVE-2026-84150

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-23 发布INFO

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowi...

CVE-2026-84098

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properl

历史摘要 · 未重新核验 · NVD

#cve #cwe-863