#CVE

共收录 63078 条相关情报。

← 返回所有主题

漏洞预警2026-10-28 发布MEDIUM

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating req...

CVE-2026-115224

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popu

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-28 发布MEDIUM

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on ...

CVE-2026-113813

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布LOW

The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, ...

CVE-2026-113494

The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listin

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-28 发布MEDIUM

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler...

CVE-2026-113488

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaSc

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布MEDIUM

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listi...

CVE-2026-113487

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link v

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布MEDIUM

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user ...

CVE-2026-113486

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, s

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-28 发布MEDIUM

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its...

CVE-2026-113485

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Libr

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-28 发布MEDIUM

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with ...

CVE-2026-111967

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before o

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布LOW

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allow...

CVE-2026-111961

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a req

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-28 发布MEDIUM

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a ...

CVE-2026-111960

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-28 发布HIGH

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress...

CVE-2026-111577

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configu

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-28 发布LOW

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability c...

CVE-2026-111032

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted produc

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-28 发布MEDIUM

The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users t...

CVE-2026-111031

The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirec

来源摘录 · NVD

#cve #cwe-601

漏洞预警2026-10-28 发布MEDIUM

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied be...

CVE-2026-111027

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-28 发布HIGH

The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leadi...

CVE-2026-111021

The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a paramete

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布MEDIUM

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthentic...

CVE-2026-110691

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-28 发布MEDIUM

The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the pag...

CVE-2026-110524

The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode att

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布MEDIUM

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, w...

CVE-2026-110509

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unaut

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-28 发布LOW

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are all...

CVE-2026-110507

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-28 发布MEDIUM

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, wh...

CVE-2026-110506

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before stori

来源摘录 · NVD

#cve #cwe-79