2026-10-28 归档

今日共收录 2009 条安全情报，包含 1141 个 CVE，471 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-10-28 发布INFO

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allow...

CVE-2026-111961

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a req

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a ...

CVE-2026-111960

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress...

CVE-2026-111577

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configu

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability c...

CVE-2026-111032

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted produc

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users t...

CVE-2026-111031

The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirec

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied be...

CVE-2026-111027

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leadi...

CVE-2026-111021

The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a paramete

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthentic...

CVE-2026-110691

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the pag...

CVE-2026-110524

The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode att

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, w...

CVE-2026-110509

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unaut

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are all...

CVE-2026-110507

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, wh...

CVE-2026-110506

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before stori

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthent...

CVE-2026-110292

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooComm

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and...

CVE-2026-109236

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predic

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-28 发布INFO

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated A...

CVE-2026-107100

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewa

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribut...

CVE-2026-107098

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's si

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscr...

CVE-2026-107097

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using t

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storin...

CVE-2026-106647

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configur

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated...

CVE-2026-106003

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce valida

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-10-28 发布INFO

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticat...

CVE-2026-106002

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of

历史摘要 · 未重新核验 · NVD

#cve