2026-10-10 归档

今日共收录 1383 条安全情报，包含 534 个 CVE，469 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-10 发布INFO

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embeddoc' shortcode in all versio...

CVE-2026-18558

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_popover_in_flex_timel...

CVE-2026-18496

The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-10 发布INFO

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and inc...

CVE-2026-17025

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions ...

CVE-2026-16776

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in all versions up to, and including, 2.8....

CVE-2026-14882

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-secti

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due t...

CVE-2026-14877

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attr

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_...

CVE-2026-14379

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all ve...

CVE-2026-14335

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficie...

CVE-2026-12054

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in al

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with C...

CVE-2026-107323

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before ou

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-10 发布INFO

The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing ...

CVE-2026-107321

The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor en

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-10 发布INFO

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short num...

CVE-2026-107120

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registra

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-10 发布INFO

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose oth...

CVE-2026-105995

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reserva

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-10 发布INFO

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauth...

CVE-2026-105990

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-10 发布INFO

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowin...

CVE-2026-105989

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or requ

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-10 发布INFO

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor ...

CVE-2026-105977

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before del

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-10 发布INFO

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor r...

CVE-2026-105976

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJA

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-10 发布INFO

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including...

CVE-2026-104899

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to

历史摘要 · 未重新核验 · NVD

#cve #cwe-98

漏洞预警2026-10-10 发布INFO

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,...

CVE-2026-104766

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to P

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-10 发布INFO

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path' parameter parameter....

CVE-2026-104763

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and i

历史摘要 · 未重新核验 · NVD

#cve #cwe-22