2026-10-11 归档

今日共收录 1127 条安全情报，包含 372 个 CVE，412 篇安全通告，以及 88 篇研究论文。

漏洞预警2026-10-10 发布INFO

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to, and including, 2...

CVE-2026-107712

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-10 发布INFO

The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the 'comm...

CVE-2026-104006

The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure

历史摘要 · 未重新核验 · NVD

#cve #cwe-524

漏洞预警2026-10-10 发布INFO

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7.9 due t...

CVE-2026-103897

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due to insufficie...

CVE-2026-103427

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in a

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)' parame...

CVE-2026-102402

The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_f

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content (rendered inline into the ...

CVE-2026-100196

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scri

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up to, and...

CVE-2026-100161

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'w

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password res...

CVE-2026-94257

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone numb

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-10-10 发布INFO

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attacker...

CVE-2026-94256

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified on

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-10 发布INFO

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by una...

CVE-2026-87781

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-10 发布INFO

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them ...

CVE-2026-87780

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthen

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing user...

CVE-2026-85571

The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering request

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-10 发布INFO

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with C...

CVE-2026-107323

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before ou

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-10 发布INFO

The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing ...

CVE-2026-107321

The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor en

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-10 发布INFO

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short num...

CVE-2026-107120

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registra

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-10 发布INFO

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose oth...

CVE-2026-105995

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reserva

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-10 发布INFO

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauth...

CVE-2026-105990

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-10 发布INFO

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowin...

CVE-2026-105989

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or requ

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-10 发布INFO

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor ...

CVE-2026-105977

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before del

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-10 发布INFO

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor r...

CVE-2026-105976

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJA

历史摘要 · 未重新核验 · NVD

#cve #cwe-863