| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-119089 | 7.2 | The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient in | 2026-11-01 18:17:12 | 2026-10-31 07:16:36 |
| CVE-2026-119065 | 7.2 | The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbd_checkout_field_update_order_meta() handler store | 2026-11-01 18:17:12 | 2026-10-31 07:16:36 |
| CVE-2026-118638 | 7.5 | The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and | 2026-11-01 18:17:11 | 2026-10-31 06:16:34 |
| CVE-2026-118629 | 5.3 | The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and | 2026-11-01 18:17:11 | 2026-10-31 06:16:34 |
| CVE-2026-118438 | 6.8 | The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute | 2026-11-01 18:17:11 | 2026-10-31 06:16:33 |
| CVE-2026-118437 | 3.7 | The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors. | 2026-11-01 18:17:11 | 2026-10-31 06:16:33 |
| CVE-2026-118593 | 5.9 | A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. Thi | 2026-11-01 18:17:11 | 2026-10-30 07:16:33 |
| CVE-2026-118168 | 5.3 | The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user ID | 2026-11-01 18:17:10 | 2026-11-01 05:18:57 |
| CVE-2026-118057 | 7.2 | The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI' parameter in all versions up to, and including, 22.3.2 due to insufficient | 2026-11-01 18:17:10 | 2026-10-31 08:16:48 |
| CVE-2026-118070 | 7.2 | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unaut | 2026-11-01 18:17:10 | 2026-10-31 07:16:36 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39953
Zapisa po stranici: