Rezultati pretraživanja za 'Od datuma: 03.11.2024.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-84740 | 6.5 | The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registere | 2026-10-02 18:00:34 | 2026-10-02 07:16:38 |
| CVE-2026-79618 | 4.3 | The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form' | 2026-10-02 18:00:34 | 2026-10-02 07:16:37 |
| CVE-2026-1661 | 4.3 | The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a p | 2026-10-02 18:00:34 | 2026-10-02 07:16:36 |
| CVE-2026-13413 | 5.3 | The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise | 2026-10-02 18:00:34 | 2026-10-02 07:16:36 |
| CVE-2026-97318 | 6.1 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaw | 2026-10-02 18:00:34 | 2026-10-02 06:16:43 |
| CVE-2026-97317 | 5.3 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any act | 2026-10-02 18:00:34 | 2026-10-02 06:16:43 |
| CVE-2026-94298 | 6.2 | The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once | 2026-10-02 18:00:34 | 2026-10-02 06:16:43 |
| CVE-2026-91828 | 7.5 | The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust th | 2026-10-02 18:00:34 | 2026-10-02 06:16:42 |
| CVE-2026-91023 | 3.1 | The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set | 2026-10-02 18:00:34 | 2026-10-02 06:16:42 |
| CVE-2026-91022 | 6.8 | The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scrip | 2026-10-02 18:00:34 | 2026-10-02 06:16:42 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/12739
Zapisa po stranici: