Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
11267 vulnerabilities
CVE-2026-15095 (GCVE-0-2026-15095)
Vulnerability from cvelistv5 – Published: 2026-09-22 08:27 – Updated: 2026-09-22 08:27
VLAI
EPSS
VEX
Title
Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter
Summary
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls: first to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal payload in wp_options, then to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the unlink(); deletion is further constrained to files whose extensions match the plugin's validated whitelist (csv, xml, tsv, xls, xlsx, json, txt).
Severity
4.9 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wahid0003 | Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels |
Affected:
0 , ≤ 6.6.43
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping, AI \u0026 Social Channels",
"vendor": "wahid0003",
"versions": [
{
"lessThanOrEqual": "6.6.43",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping \u0026 Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the \u0027provider\u0027 parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls: first to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal payload in wp_options, then to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the unlink(); deletion is further constrained to files whose extensions match the plugin\u0027s validated whitelist (csv, xml, tsv, xls, xlsx, json, txt)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T08:27:18.817Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cac5e5ca-34cc-4219-96a3-438c5a1d6a23?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/Common/Helper.php#L207"
},
{
"url": "https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/Feed/Feed.php#L113"
},
{
"url": "https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/Helper/FeedHelper.php#L38"
},
{
"url": "https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/API/V1/MakeFeed.php#L154"
},
{
"url": "https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/API/V1/ManageFeeds.php#L378"
},
{
"url": "https://plugins.trac.wordpress.org/browser/webappick-product-feed-for-woocommerce/tags/6.6.38/V5/API/RestController.php#L109"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3627934%40webappick-product-feed-for-woocommerce\u0026new=3627934%40webappick-product-feed-for-woocommerce"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T20:03:56.000Z",
"value": "Disclosed"
}
],
"title": "Product Feed Manager for WooCommerce \u003c= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via \u0027provider\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15095",
"datePublished": "2026-09-22T08:27:18.817Z",
"dateReserved": "2026-07-08T16:32:23.988Z",
"dateUpdated": "2026-09-22T08:27:18.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9231 (GCVE-0-2026-9231)
Vulnerability from cvelistv5 – Published: 2026-09-22 08:27 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
Summary
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:07 UTC
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wptravelengine | WP Travel Engine – Tour Booking Plugin – Tour Operator Software |
Affected:
0 , ≤ 6.8.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9231",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:07:43.995756Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:30.905Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software",
"vendor": "wptravelengine",
"versions": [
{
"lessThanOrEqual": "6.8.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "0xQRx"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T08:27:18.343Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/708b70c7-e4e6-4422-9682-c7d05063a188?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.7.12/includes/helpers/helpers.php#L955"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.7.12/includes/classes/Core/Shortcodes/General.php#L52"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.7.12/includes/helpers/helpers.php#L882"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.7.7/includes/helpers/helpers.php#L955"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.7.7/includes/classes/Core/Shortcodes/General.php#L52"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.7.7/includes/helpers/helpers.php#L882"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3572382/wp-travel-engine/tags/6.8.1/includes/classes/Core/Shortcodes/General.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-21T18:52:15.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T19:51:45.000Z",
"value": "Disclosed"
}
],
"title": "WP Travel Engine \u003c= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via \u0027template\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-9231",
"datePublished": "2026-09-22T08:27:18.343Z",
"dateReserved": "2026-05-21T18:37:05.008Z",
"dateUpdated": "2026-09-22T10:25:30.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93836 (GCVE-0-2026-93836)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter
Summary
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The float cast used during quantity validation allows a numeric-prefixed payload such as '1<img src=x onerror=...>' to pass validation while retaining its malicious HTML, which is then stored verbatim in order item metadata under the '_woosb_ids' key.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:07 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpclever | WPC Product Bundles for WooCommerce |
Affected:
0 , ≤ 8.6.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93836",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:07:54.238433Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:31.065Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPC Product Bundles for WooCommerce",
"vendor": "wpclever",
"versions": [
{
"lessThanOrEqual": "8.6.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lhking"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027qty\u0027 parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The float cast used during quantity validation allows a numeric-prefixed payload such as \u00271\u003cimg src=x onerror=...\u003e\u0027 to pass validation while retaining its malicious HTML, which is then stored verbatim in order item metadata under the \u0027_woosb_ids\u0027 key."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:16.170Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc620054-00ed-4c2e-9448-b40ae28efff3?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-product-bundle/tags/8.6.5/includes/class-backend.php#L1949"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-product-bundle/tags/8.6.5/includes/class-woosb.php#L1197"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-product-bundle/tags/8.6.5/includes/class-woosb.php#L584"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-product-bundle/tags/8.6.5/includes/class-woosb.php#L579"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3702892%40woo-product-bundle\u0026new=3702892%40woo-product-bundle"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T18:30:49.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T18:54:09.000Z",
"value": "Disclosed"
}
],
"title": "WPC Product Bundles for WooCommerce \u003c= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via \u0027qty\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-93836",
"datePublished": "2026-09-22T07:41:16.170Z",
"dateReserved": "2026-09-18T18:15:43.949Z",
"dateUpdated": "2026-09-22T10:25:31.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9004 (GCVE-0-2026-9004)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter
Summary
The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address information of arbitrary CRM contact records by enumerating the contact_id parameter.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:08 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nofearinc | WP-CRM System – Manage Clients and Projects |
Affected:
0 , ≤ 3.4.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9004",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:08:02.719959Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:31.220Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP-CRM System \u2013 Manage Clients and Projects",
"vendor": "nofearinc",
"versions": [
{
"lessThanOrEqual": "3.4.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Teerachai Somprasong"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP-CRM System \u2013 Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the \u0027contact_id\u0027 parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address information of arbitrary CRM contact records by enumerating the contact_id parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:15.821Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f506a9bd-2501-4437-938d-2833fc8545a9?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.6/includes/wcs-dashboard-address-book.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.6/includes/wcs-dashboard-address-book.php#L12"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.6/includes/wcs-dashboard-address-book.php#L75"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-19T13:59:25.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T19:26:14.000Z",
"value": "Disclosed"
}
],
"title": "WP-CRM System \u003c= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via \u0027contact_id\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-9004",
"datePublished": "2026-09-22T07:41:15.821Z",
"dateReserved": "2026-05-19T13:44:14.210Z",
"dateUpdated": "2026-09-22T10:25:31.220Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7622 (GCVE-0-2026-7622)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
Summary
The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the send_deactivation_survey() function registered via the wp_ajax_pl-plugin-deactivation AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the ThumbPress plugin on the affected site by sending a crafted POST request to admin-ajax.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:08 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codexpert | ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More |
Affected:
0 , ≤ 6.2.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7622",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:08:11.831143Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:31.374Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ThumbPress \u2013 Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking \u0026 More",
"vendor": "codexpert",
"versions": [
{
"lessThanOrEqual": "6.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Que Thanh Tuan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the send_deactivation_survey() function registered via the wp_ajax_pl-plugin-deactivation AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the ThumbPress plugin on the affected site by sending a crafted POST request to admin-ajax."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:15.449Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f2f998fd-eb15-442d-8034-af820601fe4a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/image-sizes/trunk/vendor/pluggable/marketing/src/Deactivator.php#L175"
},
{
"url": "https://plugins.trac.wordpress.org/browser/image-sizes/tags/5.8.37/vendor/pluggable/marketing/src/Deactivator.php#L175"
},
{
"url": "https://plugins.trac.wordpress.org/browser/image-sizes/trunk/vendor/pluggable/marketing/src/Deactivator.php#L58"
},
{
"url": "https://plugins.trac.wordpress.org/browser/image-sizes/tags/5.8.37/vendor/pluggable/marketing/src/Deactivator.php#L58"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3560270"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T19:13:13.000Z",
"value": "Disclosed"
}
],
"title": "ThumbPress \u003c= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-7622",
"datePublished": "2026-09-22T07:41:15.449Z",
"dateReserved": "2026-05-01T13:33:24.361Z",
"dateUpdated": "2026-09-22T10:25:31.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18345 (GCVE-0-2026-18345)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
Summary
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admin_init hook (which fires for every authenticated user that reaches /wp-admin/, including Subscribers) and performs no current_user_can() or nonce verification before fetching Stripe credentials from the external WPUM connect service and writing them (publishable key, secret key, gateway mode, and connected Stripe account ID) into the wpum_settings option via wpum_update_option()/update_option(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack the site's Stripe integration by completing their own Stripe Connect OAuth flow and then invoking the callback on the target site, causing all subsequent Stripe payments to be routed to the attacker's Stripe account.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:08 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpusermanager | WP User Manager – User Profile Builder & Membership |
Affected:
0 , ≤ 2.9.18
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18345",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:08:21.139344Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:31.524Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP User Manager \u2013 User Profile Builder \u0026 Membership",
"vendor": "wpusermanager",
"versions": [
{
"lessThanOrEqual": "2.9.18",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admin_init hook (which fires for every authenticated user that reaches /wp-admin/, including Subscribers) and performs no current_user_can() or nonce verification before fetching Stripe credentials from the external WPUM connect service and writing them (publishable key, secret key, gateway mode, and connected Stripe account ID) into the wpum_settings option via wpum_update_option()/update_option(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack the site\u0027s Stripe integration by completing their own Stripe Connect OAuth flow and then invoking the callback on the target site, causing all subsequent Stripe payments to be routed to the attacker\u0027s Stripe account."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:15.088Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ecae11ec-c952-4f5a-9e55-e2ac2fa05100?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.18/includes/integrations/stripe/Connect.php#L203"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.18/includes/integrations/stripe/Connect.php#L21"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.18/includes/integrations/stripe/Connect.php#L177"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3701837%40wp-user-manager\u0026new=3701837%40wp-user-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-29T22:30:58.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T18:59:14.000Z",
"value": "Disclosed"
}
],
"title": "WP User Manager \u003c= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18345",
"datePublished": "2026-09-22T07:41:15.088Z",
"dateReserved": "2026-07-29T22:15:48.642Z",
"dateUpdated": "2026-09-22T10:25:31.524Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1280 (GCVE-0-2025-1280)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read
Summary
The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:08 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SeaTheme | BM Content Builder |
Affected:
0 , < 3.17.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1280",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:08:28.302015Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:31.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BM Content Builder",
"vendor": "SeaTheme",
"versions": [
{
"lessThan": "3.17.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tonn"
}
],
"descriptions": [
{
"lang": "en",
"value": "The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:14.703Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e96376d3-4d17-4611-bdbf-1bb9c68c0ba4?source=cve"
},
{
"url": "https://themeforest.net/item/art-simple-clean-wordpress-theme-for-creatives/20170299"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T19:34:40.000Z",
"value": "Disclosed"
}
],
"title": "BM Content Builder \u003c 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-1280",
"datePublished": "2026-09-22T07:41:14.703Z",
"dateReserved": "2025-02-13T15:56:16.620Z",
"dateUpdated": "2026-09-22T10:25:31.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14487 (GCVE-0-2025-14487)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter
Summary
The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:08 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kamleshyadav | Handily |
Affected:
0 , ≤ 1.0.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14487",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:08:37.103931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:31.838Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Handily",
"vendor": "kamleshyadav",
"versions": [
{
"lessThanOrEqual": "1.0.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phat RiO"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:14.339Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e72849aa-48b0-4e66-995c-3fb4c7af99e9?source=cve"
},
{
"url": "https://codecanyon.net/item/handily-booking-system/34581545"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T19:35:07.000Z",
"value": "Disclosed"
}
],
"title": "Handily \u003c= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via \u0027stripe_publishbale_key\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-14487",
"datePublished": "2026-09-22T07:41:14.339Z",
"dateReserved": "2025-12-10T20:25:21.634Z",
"dateUpdated": "2026-09-22T10:25:31.838Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93778 (GCVE-0-2026-93778)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
WP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)
Summary
The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload originates from an anonymous Yelp reviewer on a public platform and requires no WordPress account; it is introduced into the database during the site administrator's ordinary use of the plugin's Download Reviews feature, making the effective attacker unauthenticated.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:08 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jgwhite33 | WP Yelp Review Slider |
Affected:
0 , ≤ 9.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93778",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:08:50.526323Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:31.995Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Yelp Review Slider",
"vendor": "jgwhite33",
"versions": [
{
"lessThanOrEqual": "9.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ivaylo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload originates from an anonymous Yelp reviewer on a public platform and requires no WordPress account; it is introduced into the database during the site administrator\u0027s ordinary use of the plugin\u0027s Download Reviews feature, making the effective attacker unauthenticated."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:13.965Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/df6cbc36-d136-49c1-81f0-a61cb91f0ad7?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-yelp-review-slider/tags/9.1/public/partials/template_style_1.php#L129"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-yelp-review-slider/tags/9.1/public/partials/template_style_1.php#L95"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-yelp-review-slider/tags/9.1/admin/class-wp-yelp-review-slider-admin.php#L1659"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-yelp-review-slider/tags/9.1/admin/class-wp-yelp-review-slider-admin.php#L1336"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-yelp-review-slider/tags/9.1/admin/class-wp-yelp-review-slider-admin.php#L1358"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-yelp-review-slider/tags/9.1/admin/class-wp-yelp-review-slider-admin.php#L1140"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3704718%40wp-yelp-review-slider\u0026new=3704718%40wp-yelp-review-slider"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T18:06:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T19:00:01.000Z",
"value": "Disclosed"
}
],
"title": "WP Yelp Review Slider \u003c= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-93778",
"datePublished": "2026-09-22T07:41:13.965Z",
"dateReserved": "2026-09-18T17:51:47.468Z",
"dateUpdated": "2026-09-22T10:25:31.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92235 (GCVE-0-2026-92235)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
Summary
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:08 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| roxnor | WP Ultimate Review |
Affected:
0 , ≤ 2.4.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92235",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:08:59.756351Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:32.150Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Ultimate Review",
"vendor": "roxnor",
"versions": [
{
"lessThanOrEqual": "2.4.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "jtb75"
}
],
"descriptions": [
{
"lang": "en",
"value": "The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:13.593Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dc0fe855-97b7-46ef-b1c8-1602447e97e6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L360"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L341"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L189"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/app/content.php#L56"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/init.php#L271"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.2/views/public/meta-box-user-review.php#L538"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3703958%40wp-ultimate-review\u0026new=3703958%40wp-ultimate-review"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-15T19:36:06.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "WP Ultimate Review \u003c= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via \u0027xs_submit_review_data[xs_reviw_summery]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-92235",
"datePublished": "2026-09-22T07:41:13.593Z",
"dateReserved": "2026-09-15T19:31:28.783Z",
"dateUpdated": "2026-09-22T10:25:32.150Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91092 (GCVE-0-2026-91092)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 07:41
VLAI
EPSS
VEX
Title
wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
Summary
The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to take over another guest author's forum post and modify its title, body, author name, and stored owner email address. This requires that guest posting and editing are enabled on the forum, and that the attacker knows the target guest author's email address.
Severity
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tomdever | wpForo Forum |
Affected:
0 , ≤ 3.1.5
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "wpForo Forum",
"vendor": "tomdever",
"versions": [
{
"lessThanOrEqual": "3.1.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonah Burgess (CryptoCat)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to take over another guest author\u0027s forum post and modify its title, body, author name, and stored owner email address. This requires that guest posting and editing are enabled on the forum, and that the attacker knows the target guest author\u0027s email address."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:13.210Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/97084759-a8fb-4b26-a6fa-93d005b1110e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Posts.php#L319"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/includes/functions.php#L2820"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Members.php#L3704"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Actions.php#L806"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/includes/hooks.php#L1004"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3702319%40wpforo\u0026new=3702319%40wpforo"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T18:24:03.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T19:01:21.000Z",
"value": "Disclosed"
}
],
"title": "wpForo Forum \u003c= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-91092",
"datePublished": "2026-09-22T07:41:13.210Z",
"dateReserved": "2026-09-14T18:11:51.829Z",
"dateUpdated": "2026-09-22T07:41:13.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6922 (GCVE-0-2026-6922)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 07:41
VLAI
EPSS
VEX
Title
WP Table Builder <= 2.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter
Summary
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs.
Severity
7.1 (High)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wptb | WP Table Builder – Drag & Drop Table Builder |
Affected:
0 , ≤ 2.2.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Table Builder \u2013 Drag \u0026 Drop Table Builder",
"vendor": "wptb",
"versions": [
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qu\u1ed1c Huy (jtwings)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Table Builder \u2013 Drag \u0026 Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:12.841Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c9ae1cd-c2fa-40a3-88f7-9ee7428391e5?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-table-builder/trunk/inc/Admin/Authorization.php#L9"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-table-builder/trunk/inc/Core/Settings.php#L107"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-table-builder/trunk/inc/Admin/Api/TablePost.php#L299"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-table-builder/tags/2.1.10/inc/Admin/Api/TablePost.php#L299"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-table-builder/trunk/inc/Admin/Api/TablePost.php#L318"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-table-builder/tags/2.1.10/inc/Admin/Api/TablePost.php#L318"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-table-builder/trunk/inc/Admin/Api/TablePost.php#L292"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-table-builder/tags/2.1.10/inc/Admin/Api/TablePost.php#L292"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-table-builder/tags/2.1.10/inc/Admin/Authorization.php#L9"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-table-builder/tags/2.1.10/inc/Core/Settings.php#L107"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3676426"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-23T16:36:36.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T18:57:04.000Z",
"value": "Disclosed"
}
],
"title": "WP Table Builder \u003c= 2.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via \u0027ids\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-6922",
"datePublished": "2026-09-22T07:41:12.841Z",
"dateReserved": "2026-04-23T16:21:25.277Z",
"dateUpdated": "2026-09-22T07:41:12.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1645 (GCVE-0-2026-1645)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 07:41
VLAI
EPSS
VEX
Title
Hostel <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting
Summary
The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Severity
4.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Hostel",
"vendor": "prasunsen",
"versions": [
{
"lessThanOrEqual": "1.1.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bee"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027custom_currency\u0027 parameter and the \u0027locale_url\u0027 setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:12.398Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/75693bd1-f022-47b9-b498-5ea1bda387e3?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/views/options.php#L17"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/models/hostel.php#L266"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/helpers/htmlhelper.php#L275"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/helpers/htmlhelper.php#L278"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T19:02:52.000Z",
"value": "Disclosed"
}
],
"title": "Hostel \u003c= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via \u0027custom_currency\u0027 Parameter and Localization file URL Setting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-1645",
"datePublished": "2026-09-22T07:41:12.398Z",
"dateReserved": "2026-01-29T18:38:50.307Z",
"dateUpdated": "2026-09-22T07:41:12.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18439 (GCVE-0-2026-18439)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 07:41
VLAI
EPSS
VEX
Title
Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
Summary
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload['ID'], but the nested identifiers are passed straight into $wpdb->update/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows.
Severity
4.3 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| themeum | Tutor LMS – eLearning and online course solution |
Affected:
0 , ≤ 4.0.7
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tutor LMS \u2013 eLearning and online course solution",
"vendor": "themeum",
"versions": [
{
"lessThanOrEqual": "4.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nakul Chodha"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload[\u0027ID\u0027], but the nested identifiers are passed straight into $wpdb-\u003eupdate/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:12.011Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d07c82d-262a-4ac1-9ee5-7ef4d025f66f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.3/classes/QuizBuilder.php#L291"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.3/classes/QuizBuilder.php#L156"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.3/classes/QuizBuilder.php#L423"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.3/classes/QuizBuilder.php#L430"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.3/classes/QuizBuilder.php#L781"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.10/classes/QuizBuilder.php#L291"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.10/classes/QuizBuilder.php#L156"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.10/classes/QuizBuilder.php#L423"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.10/classes/QuizBuilder.php#L430"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.10/classes/QuizBuilder.php#L781"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3690454/tutor/tags/4.0.8/classes/QuizBuilder.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-30T20:38:30.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T18:52:22.000Z",
"value": "Disclosed"
}
],
"title": "Tutor LMS \u003c= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via \u0027payload\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18439",
"datePublished": "2026-09-22T07:41:12.011Z",
"dateReserved": "2026-07-30T20:23:23.648Z",
"dateUpdated": "2026-09-22T07:41:12.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1281 (GCVE-0-2025-1281)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion
Summary
The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:09 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SeaTheme | BM Content Builder |
Affected:
0 , < 3.17.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1281",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:09:08.180588Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:32.309Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BM Content Builder",
"vendor": "SeaTheme",
"versions": [
{
"lessThan": "3.17.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tonn"
}
],
"descriptions": [
{
"lang": "en",
"value": "The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:11.568Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/61084da5-fa8d-4fa9-a6a6-6155e9e25fbc?source=cve"
},
{
"url": "https://themeforest.net/item/art-simple-clean-wordpress-theme-for-creatives/20170299"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T19:37:37.000Z",
"value": "Disclosed"
}
],
"title": "BM Content Builder \u003c 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-1281",
"datePublished": "2026-09-22T07:41:11.568Z",
"dateReserved": "2025-02-13T16:00:23.119Z",
"dateUpdated": "2026-09-22T10:25:32.309Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4123 (GCVE-0-2026-4123)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action
Summary
The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the toggle_cache() function which is hooked to the wp_ajax_toggle_cache AJAX action. The function also lacks nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to toggle the plugin's cache setting on or off by sending a POST request to admin-ajax.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:09 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rwelephant01 | RW Elephant Rental Inventory |
Affected:
0 , ≤ 2.3.13
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:09:19.299773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:32.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RW Elephant Rental Inventory",
"vendor": "rwelephant01",
"versions": [
{
"lessThanOrEqual": "2.3.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nabil Irawan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the toggle_cache() function which is hooked to the wp_ajax_toggle_cache AJAX action. The function also lacks nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to toggle the plugin\u0027s cache setting on or off by sending a POST request to admin-ajax."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:11.190Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e46beca-e33b-4ed9-a0ab-612a6987174e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/trunk/lib/classes/class-options.php#L1524"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/tags/2.3.11/lib/classes/class-options.php#L1524"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/trunk/lib/classes/class-options.php#L75"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rw-elephant-rental-inventory/tags/2.3.11/lib/classes/class-options.php#L75"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3551183"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-14T15:56:40.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T18:48:08.000Z",
"value": "Disclosed"
}
],
"title": "RW Elephant Rental Inventory \u003c= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via \u0027toggle_cache\u0027 AJAX Action"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-4123",
"datePublished": "2026-09-22T07:41:11.190Z",
"dateReserved": "2026-03-13T13:37:50.598Z",
"dateUpdated": "2026-09-22T10:25:32.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14484 (GCVE-0-2025-14484)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter
Summary
The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys (Pixabay, Unsplash, Pixels) configured by site administrators via the 'pixabay_api', 'unsplash_api', or 'pixels_api' parameters.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:09 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kamleshyadav | Image Buzz |
Affected:
0 , ≤ 1.0.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14484",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:09:28.008719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:32.619Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Image Buzz",
"vendor": "kamleshyadav",
"versions": [
{
"lessThanOrEqual": "1.0.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phat RiO"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys (Pixabay, Unsplash, Pixels) configured by site administrators via the \u0027pixabay_api\u0027, \u0027unsplash_api\u0027, or \u0027pixels_api\u0027 parameters."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:10.819Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3d1c7383-ac3b-48b3-aaea-729a36e77ff5?source=cve"
},
{
"url": "https://codecanyon.net/item/image-buzz-free-stock-images-wordpress-plugin/42500370"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T19:38:18.000Z",
"value": "Disclosed"
}
],
"title": "Image Buzz \u003c= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via \u0027pixabay_api\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-14484",
"datePublished": "2026-09-22T07:41:10.819Z",
"dateReserved": "2025-12-10T20:07:23.652Z",
"dateUpdated": "2026-09-22T10:25:32.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14486 (GCVE-0-2025-14486)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
PixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter
Summary
The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys (Pixabay, Unsplash, Pixels, OpenAI) configured by site administrators via the 'clear_api_type' parameter.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:09 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kamleshyadav | PixelPlay |
Affected:
0 , ≤ 1.0.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14486",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:09:36.582913Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:32.774Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PixelPlay",
"vendor": "kamleshyadav",
"versions": [
{
"lessThanOrEqual": "1.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phat RiO"
}
],
"descriptions": [
{
"lang": "en",
"value": "The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys (Pixabay, Unsplash, Pixels, OpenAI) configured by site administrators via the \u0027clear_api_type\u0027 parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:10.433Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/20589c53-56ff-41ba-857d-40b947a0e55c?source=cve"
},
{
"url": "https://elements.envato.com/pixelplay-video-autoplay-wordpress-plugin-SPE7EM9"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T19:38:39.000Z",
"value": "Disclosed"
}
],
"title": "PixelPlay \u003c= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via \u0027clear_api_type\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-14486",
"datePublished": "2026-09-22T07:41:10.433Z",
"dateReserved": "2025-12-10T20:23:20.959Z",
"dateUpdated": "2026-09-22T10:25:32.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92969 (GCVE-0-2026-92969)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX
Summary
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users because the only access control is a nonce check against woof_front_nonce, which is publicly emitted into inline JavaScript on every front-end page and is therefore obtainable by any site visitor without authentication.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:09 UTC
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| realmag777 | HUSKY – Products Filter for WooCommerce Professional |
Affected:
0 , ≤ 1.4.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92969",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:09:49.016825Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:32.927Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HUSKY \u2013 Products Filter for WooCommerce Professional",
"vendor": "realmag777",
"versions": [
{
"lessThanOrEqual": "1.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "crow"
}
],
"descriptions": [
{
"lang": "en",
"value": "The HUSKY \u2013 Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the \u0027shortcode\u0027 parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users because the only access control is a nonce check against woof_front_nonce, which is publicly emitted into inline JavaScript on every front-end page and is therefore obtainable by any site visitor without authentication."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:10.064Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1f71b558-e8c0-441e-b437-a7f30ad13513?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/index.php#L3600"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/index.php#L2677"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/index.php#L2789"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/index.php#L2771"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/index.php#L267"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/index.php#L1044"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3701864%40woocommerce-products-filter\u0026new=3701864%40woocommerce-products-filter"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-17T13:38:11.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T18:55:00.000Z",
"value": "Disclosed"
}
],
"title": "HUSKY \u003c= 1.4.4 - Unauthenticated Local File Inclusion via \u0027custom_tpl\u0027 Shortcode Attribute via \u0027woof_draw_products\u0027 AJAX"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-92969",
"datePublished": "2026-09-22T07:41:10.064Z",
"dateReserved": "2026-09-17T13:23:20.265Z",
"dateUpdated": "2026-09-22T10:25:32.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16778 (GCVE-0-2026-16778)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
Live Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content
Summary
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time wp_kses_post check is bypassed because the payload is stored as a serialized string containing no HTML tags for kses to tokenize, and the shortcode callback re-emits attacker-controlled values — including view_all_link (href attribute), main_heading_title (h2 body), button_text (anchor body), and button_inline_svg (anchor body) — without any escaping at render time.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:10 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| livecomposer | Live Composer – Free WordPress Website Builder |
Affected:
0 , ≤ 2.1.21
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16778",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:10:02.332597Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:33.118Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Live Composer \u2013 Free WordPress Website Builder",
"vendor": "livecomposer",
"versions": [
{
"lessThanOrEqual": "2.1.21",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Live Composer \u2013 Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027dslc_module_downloads_output\u0027 Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time wp_kses_post check is bypassed because the payload is stored as a serialized string containing no HTML tags for kses to tokenize, and the shortcode callback re-emits attacker-controlled values \u2014 including view_all_link (href attribute), main_heading_title (h2 body), button_text (anchor body), and button_inline_svg (anchor body) \u2014 without any escaping at render time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:09.668Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1d072660-515c-4fd9-903b-815447786e03?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/downloads/module.php#L5508"
},
{
"url": "https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/downloads/module.php#L5225"
},
{
"url": "https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/downloads/module.php#L5219"
},
{
"url": "https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/downloads/module.php#L5502"
},
{
"url": "https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/downloads/module.php#L4978"
},
{
"url": "https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.18/modules/downloads/module.php#L5685"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3705127%40live-composer-page-builder\u0026new=3705127%40live-composer-page-builder"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-23T17:33:11.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T19:04:19.000Z",
"value": "Disclosed"
}
],
"title": "Live Composer \u003c= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027dslc_module_downloads_output\u0027 Shortcode Content"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-16778",
"datePublished": "2026-09-22T07:41:09.668Z",
"dateReserved": "2026-07-23T17:18:04.183Z",
"dateUpdated": "2026-09-22T10:25:33.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12995 (GCVE-0-2026-12995)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter
Summary
The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the edit_meta_value due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary media attachments site-wide by supplying any numeric attachment ID in the file-field parameter alongside the corresponding delete flag, causing content loss and broken pages. Exploitation requires that the attacker's post is governed by a Custom Field Template containing at least one file-type field with the mediaRemove option not enabled, which is the default configuration for file fields.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:10 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hiroaki-miyashita | Custom Field Template |
Affected:
0 , ≤ 2.7.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12995",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:10:12.838575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:33.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Custom Field Template",
"vendor": "hiroaki-miyashita",
"versions": [
{
"lessThanOrEqual": "2.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dmitrii Ignatyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the edit_meta_value due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary media attachments site-wide by supplying any numeric attachment ID in the file-field parameter alongside the corresponding delete flag, causing content loss and broken pages. Exploitation requires that the attacker\u0027s post is governed by a Custom Field Template containing at least one file-type field with the mediaRemove option not enabled, which is the default configuration for file fields."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:09.117Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/02f44f5b-c513-4aba-b895-65df681620c6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L3500"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L3462"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.8/custom-field-template.php#L105"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L3500"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L3462"
},
{
"url": "https://plugins.trac.wordpress.org/browser/custom-field-template/tags/2.7.7/custom-field-template.php#L105"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3589466%40custom-field-template\u0026new=3589466%40custom-field-template"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T18:42:31.000Z",
"value": "Disclosed"
}
],
"title": "Custom Field Template \u003c= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via \u0027file_field\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12995",
"datePublished": "2026-09-22T07:41:09.117Z",
"dateReserved": "2026-06-23T13:14:40.474Z",
"dateUpdated": "2026-09-22T10:25:33.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94504 (GCVE-0-2026-94504)
Vulnerability from cvelistv5 – Published: 2026-09-22 06:39 – Updated: 2026-09-22 06:39
VLAI
EPSS
VEX
Title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting
Summary
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.
Severity
7.2 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kstover | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder |
Affected:
0 , ≤ 3.15.3
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures \u0026 AI Form Builder",
"vendor": "kstover",
"versions": [
{
"lessThanOrEqual": "3.15.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hippolyte Qu\u00e9r\u00e9 (Hippie) (Hippie)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T06:39:41.379Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c599a562-5218-4b37-bcf7-0e82008a4e68?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Fields/Textarea.php#L35"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/includes/Fields/Textarea.php#L35"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Templates/admin-metabox-sub-fields.html.php#L23"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Database/Models/Submission.php#L205"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3705719%40ninja-forms%2Ftags%2F3.15.4\u0026old=3685242%40ninja-forms%2Ftags%2F3.15.3"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-11T20:28:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T18:15:56.000Z",
"value": "Disclosed"
}
],
"title": "Ninja Forms \u2013 The Contact Form Builder That Grows With You \u003c= 3.15.3 - Stored Cross-Site Scripting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-94504",
"datePublished": "2026-09-22T06:39:41.379Z",
"dateReserved": "2026-09-21T18:14:35.313Z",
"dateUpdated": "2026-09-22T06:39:41.379Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89412 (GCVE-0-2026-89412)
Vulnerability from cvelistv5 – Published: 2026-09-22 06:39 – Updated: 2026-09-22 06:39
VLAI
EPSS
VEX
Title
TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel
Summary
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel (v-html on suggestion.original) in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers can seed the translation dictionary's original column with executable HTML because the front-end rendering pipeline decodes entity-encoded payloads via html_entity_decode() before persistence, and the original column is deliberately exempt from kses filtering — meaning no save-time sanitizer neutralizes the stored payload before it is later rendered in an administrator's session.
Severity
7.2 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
13 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cozmoslabs | TranslatePress – Translate Multilingual sites with AI Translation |
Affected:
0 , ≤ 3.3.5
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TranslatePress \u2013 Translate Multilingual sites with AI Translation",
"vendor": "cozmoslabs",
"versions": [
{
"lessThanOrEqual": "3.3.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Liu"
}
],
"descriptions": [
{
"lang": "en",
"value": "The TranslatePress \u2013 Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel (v-html on suggestion.original) in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers can seed the translation dictionary\u0027s original column with executable HTML because the front-end rendering pipeline decodes entity-encoded payloads via html_entity_decode() before persistence, and the original column is deliberately exempt from kses filtering \u2014 meaning no save-time sanitizer neutralizes the stored payload before it is later rendered in an administrator\u0027s session."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T06:39:40.880Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/717e8479-921b-4f18-8fbe-32e0d8a37590?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.5/assets/src/js/components/translation-memory.vue#L12"
},
{
"url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.5/includes/class-translation-memory.php#L47"
},
{
"url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.5/includes/class-translation-memory.php#L60"
},
{
"url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.5/includes/class-translation-render.php#L1024"
},
{
"url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.5/includes/class-translation-render.php#L996"
},
{
"url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.3/assets/src/js/components/translation-memory.vue#L12"
},
{
"url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.3/includes/class-translation-memory.php#L47"
},
{
"url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.3/includes/class-translation-memory.php#L60"
},
{
"url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.3/includes/class-translation-render.php#L1024"
},
{
"url": "https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.3/includes/class-translation-render.php#L996"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3697206%40translatepress-multilingual%2Ftags%2F3.3.6\u0026old=3686891%40translatepress-multilingual%2Ftags%2F3.3.5"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3697206/translatepress-multilingual/trunk/assets/src/js/components/translation-memory.vue"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-11T17:22:25.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T17:38:25.000Z",
"value": "Disclosed"
}
],
"title": "TranslatePress \u003c= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-89412",
"datePublished": "2026-09-22T06:39:40.880Z",
"dateReserved": "2026-09-11T16:38:29.057Z",
"dateUpdated": "2026-09-22T06:39:40.880Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93655 (GCVE-0-2026-93655)
Vulnerability from cvelistv5 – Published: 2026-09-22 05:30 – Updated: 2026-09-22 12:44
VLAI
EPSS
VEX
Title
Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
Summary
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and including, 11.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 12:43 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpdevelop | Booking Calendar |
Affected:
0 , ≤ 11.8.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93655",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T12:43:02.009381Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T12:44:10.086Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Booking Calendar",
"vendor": "wpdevelop",
"versions": [
{
"lessThanOrEqual": "11.8.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Asaf Mozes"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027wpbc_auto_fill\u0027 parameter in all versions up to, and including, 11.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T05:30:43.607Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/37fdbbc3-6151-4962-90fa-a621d01a5eb2?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/booking/tags/11.8.3/_dist/all/_src/wpbc_all.js#L3396"
},
{
"url": "https://plugins.trac.wordpress.org/browser/booking/tags/11.8.3/js/wpbc_time-selector.js#L87"
},
{
"url": "https://plugins.trac.wordpress.org/browser/booking/tags/11.8.3/_dist/all/_src/wpbc_all.js#L3370"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3703002%40booking\u0026new=3703002%40booking"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T13:32:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T16:44:33.000Z",
"value": "Disclosed"
}
],
"title": "Booking Calendar \u003c= 11.8.3 - Reflected Cross-Site Scripting via \u0027wpbc_auto_fill\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-93655",
"datePublished": "2026-09-22T05:30:43.607Z",
"dateReserved": "2026-09-18T13:17:46.126Z",
"dateUpdated": "2026-09-22T12:44:10.086Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12470 (GCVE-0-2026-12470)
Vulnerability from cvelistv5 – Published: 2026-09-22 05:30 – Updated: 2026-09-22 13:23
VLAI
EPSS
VEX
Title
CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action
Summary
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 13:22 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| niteo | CMP – Coming Soon & Maintenance Plugin by NiteoThemes |
Affected:
0 , ≤ 4.1.17
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12470",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T13:22:53.873003Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T13:23:05.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CMP \u2013 Coming Soon \u0026 Maintenance Plugin by NiteoThemes",
"vendor": "niteo",
"versions": [
{
"lessThanOrEqual": "4.1.17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nh\u01b0 Nguy\u1ec5n"
}
],
"descriptions": [
{
"lang": "en",
"value": "The CMP \u2013 Coming Soon \u0026 Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the \u0027cmp_ajax_import_settings\u0027 AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T05:30:43.263Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/20e2f410-72a9-4d94-b80d-1cb625c08962?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.17/niteo-cmp.php#L3143"
},
{
"url": "https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.17/niteo-cmp.php#L3104"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3661069%40cmp-coming-soon-maintenance\u0026new=3661069%40cmp-coming-soon-maintenance"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T16:45:20.000Z",
"value": "Disclosed"
}
],
"title": "CMP \u003c= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12470",
"datePublished": "2026-09-22T05:30:43.263Z",
"dateReserved": "2026-06-16T19:39:31.956Z",
"dateUpdated": "2026-09-22T13:23:05.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85653 (GCVE-0-2026-85653)
Vulnerability from cvelistv5 – Published: 2026-09-22 05:30 – Updated: 2026-09-22 05:30
VLAI
EPSS
VEX
Title
Contextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter
Summary
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Block Parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ajay | Contextual Related Posts |
Affected:
0 , ≤ 4.4.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Contextual Related Posts",
"vendor": "ajay",
"versions": [
{
"lessThanOrEqual": "4.4.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Athiwat Tiprasaharn (Jitlada)"
},
{
"lang": "en",
"type": "finder",
"value": "Itthidej Aramsri (Boeing777)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027other_attributes\u0027 Block Parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T05:30:42.725Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1ee59a73-c449-462d-9ff0-b652be56b73b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/contextual-related-posts/tags/4.4.0/includes/frontend/class-media-handler.php#L972"
},
{
"url": "https://plugins.trac.wordpress.org/browser/contextual-related-posts/tags/4.4.0/includes/frontend/blocks/class-blocks.php#L95"
},
{
"url": "https://plugins.trac.wordpress.org/browser/contextual-related-posts/tags/4.4.0/includes/frontend/class-media-handler.php#L133"
},
{
"url": "https://plugins.trac.wordpress.org/browser/contextual-related-posts/tags/4.4.0/includes/frontend/class-media-handler.php#L854"
},
{
"url": "https://plugins.trac.wordpress.org/browser/contextual-related-posts/tags/4.2.4/includes/frontend/class-media-handler.php#L972"
},
{
"url": "https://plugins.trac.wordpress.org/browser/contextual-related-posts/tags/4.2.4/includes/frontend/blocks/class-blocks.php#L95"
},
{
"url": "https://plugins.trac.wordpress.org/browser/contextual-related-posts/tags/4.2.4/includes/frontend/class-media-handler.php#L133"
},
{
"url": "https://plugins.trac.wordpress.org/browser/contextual-related-posts/tags/4.2.4/includes/frontend/class-media-handler.php#L854"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3703115%40contextual-related-posts\u0026new=3703115%40contextual-related-posts"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-19T06:50:21.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T16:46:11.000Z",
"value": "Disclosed"
}
],
"title": "Contextual Related Posts \u003c= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via \u0027other_attributes\u0027 Block Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-85653",
"datePublished": "2026-09-22T05:30:42.725Z",
"dateReserved": "2026-09-04T13:11:31.767Z",
"dateUpdated": "2026-09-22T05:30:42.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19658 (GCVE-0-2026-19658)
Vulnerability from cvelistv5 – Published: 2026-09-22 04:27 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
Summary
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only reachable when the "Allow Multiple Recipients" option is enabled for the donation form, as the single-recipient code path applies sanitize_textarea_field() which would neutralize the payload. Exploitation additionally requires the eCard "Custom Message" option to be disabled, which is the plugin default: when it is enabled the personalized message becomes a required field and GiveWP's give_clean() blanks serialized input during validation, causing the donation to be rejected before it is stored.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:10 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| LiquidWeb | Give Tributes |
Affected:
0 , ≤ 2.3.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19658",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:10:29.938501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:33.429Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Give Tributes",
"vendor": "LiquidWeb",
"versions": [
{
"lessThanOrEqual": "2.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Voyag3r-Security"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only reachable when the \"Allow Multiple Recipients\" option is enabled for the donation form, as the single-recipient code path applies sanitize_textarea_field() which would neutralize the payload. Exploitation additionally requires the eCard \"Custom Message\" option to be disabled, which is the plugin default: when it is enabled the personalized message becomes a required field and GiveWP\u0027s give_clean() blanks serialized input during validation, causing the donation to be rejected before it is stored."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T04:27:38.713Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0cdd5562-8755-4ca3-9c16-a5b364f8408b?source=cve"
},
{
"url": "https://www.liquidweb.com/software/give/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-22T15:57:53.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T15:55:06.000Z",
"value": "Disclosed"
}
],
"title": "Give Tributes \u003c= 2.3.1 - Unauthenticated PHP Object Injection via \u0027give_tributes_ecard_notify[recipient][personalized][]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-19658",
"datePublished": "2026-09-22T04:27:38.713Z",
"dateReserved": "2026-08-12T18:57:11.799Z",
"dateUpdated": "2026-09-22T10:25:33.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13355 (GCVE-0-2026-13355)
Vulnerability from cvelistv5 – Published: 2026-09-22 04:27 – Updated: 2026-09-22 10:25
VLAI
EPSS
VEX
Title
Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
Summary
The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form's target object_id from the GET parameter 'rwmb_frontend_field_object_id' without any authorization check, and Form::process() lacks the user_can_edit() check present in render(), allowing unauthenticated attackers to overwrite the post_content of any page with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then directly trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode with no role validation. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator. The standalone plugins Meta Box Frontend Submission (in versions up to 4.5.6) and Meta Box User Profile (versions up to 3.11.0) are also affected.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 10:10 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Meta Box | Meta Box Frontend Submission |
Affected:
0 , ≤ 4.5.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13355",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T10:10:42.103994Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T10:25:33.585Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Meta Box Frontend Submission",
"vendor": "Meta Box",
"versions": [
{
"lessThanOrEqual": "4.5.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "h0xilo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form\u0027s target object_id from the GET parameter \u0027rwmb_frontend_field_object_id\u0027 without any authorization check, and Form::process() lacks the user_can_edit() check present in render(), allowing unauthenticated attackers to overwrite the post_content of any page with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then directly trusts the \u0027role\u0027 and \u0027auto_login\u0027 shortcode attributes in the injected [mb_user_profile_register] shortcode with no role validation. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator. The standalone plugins Meta Box Frontend Submission (in versions up to 4.5.6) and Meta Box User Profile (versions up to 3.11.0) are also affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T04:27:39.996Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3b7b6e7e-b944-45f8-a6d8-bfd859bec0d1?source=cve"
},
{
"url": "https://metabox.io/changelog/"
},
{
"url": "https://metabox.io/plugins/meta-box-aio/changelog/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-26T17:30:02.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T16:26:40.000Z",
"value": "Disclosed"
}
],
"title": "Meta Box AIO \u003c= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to \u0027rwmb_frontend_field_object_id\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-13355",
"datePublished": "2026-09-22T04:27:37.491Z",
"dateReserved": "2026-06-25T17:01:22.722Z",
"dateUpdated": "2026-09-22T10:25:33.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9858 (GCVE-0-2026-9858)
Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-20 00:35
VLAI
EPSS
VEX
Title
Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions
Summary
The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php (registered at lines 60–62 and implemented at lines 228, 263, and 291) lacking both capability checks and nonce verification, and not validating the calling user's ownership of the supplied order_id. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order item details (names, quantities, shipped counts) belonging to any customer and to modify the shipment status / shipped quantities of any order, which can also trigger order status transitions via the wxp_order_status action.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:17 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpexpertshub | Partial Shipment for WooCommerce |
Affected:
0 , ≤ 3.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9858",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:17:03.223646Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T00:35:29.208Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Partial Shipment for WooCommerce",
"vendor": "wpexpertshub",
"versions": [
{
"lessThanOrEqual": "3.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhan Luo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php (registered at lines 60\u201362 and implemented at lines 228, 263, and 291) lacking both capability checks and nonce verification, and not validating the calling user\u0027s ownership of the supplied order_id. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order item details (names, quantities, shipped counts) belonging to any customer and to modify the shipment status / shipped quantities of any order, which can also trigger order status transitions via the wxp_order_status action."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:24.252Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d9278c56-b963-4d9b-ae5a-45dab44c701f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wc-partial-shipment/tags/3.4/woocommerce-partial-shipment.php#L291"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wc-partial-shipment/tags/3.4/woocommerce-partial-shipment.php#L228"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wc-partial-shipment/tags/3.4/woocommerce-partial-shipment.php#L263"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wc-partial-shipment/tags/3.4/woocommerce-partial-shipment.php#L60"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3561104%40wc-partial-shipment\u0026new=3561104%40wc-partial-shipment"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:59:23.000Z",
"value": "Disclosed"
}
],
"title": "Partial Shipment for Woocommerce \u003c= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-9858",
"datePublished": "2026-09-19T08:27:24.252Z",
"dateReserved": "2026-05-28T15:55:58.558Z",
"dateUpdated": "2026-09-20T00:35:29.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9613 (GCVE-0-2026-9613)
Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)
Summary
The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store's stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin's stored API token, and trigger shipping notification emails to customers.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:17 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
18 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| datalogics | Datalogics Ecommerce Delivery – Datalogics |
Affected:
0 , ≤ 2.6.65
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9613",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:17:09.324009Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:18.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Datalogics Ecommerce Delivery \u2013 Datalogics",
"vendor": "datalogics",
"versions": [
{
"lessThanOrEqual": "2.6.65",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Benedictus Jovan (aillesiM)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Datalogics Ecommerce Delivery \u2013 Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store\u0027s stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin\u0027s stored API token, and trigger shipping notification emails to customers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:23.913Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ed27b8-dbdc-4927-8019-52a622bfbff6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L679"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L691"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L809"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L198"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L244"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L5"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L76"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L646"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L679"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L691"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L809"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L198"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L244"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L5"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L76"
},
{
"url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L646"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3552733%40datalogics\u0026new=3552733%40datalogics"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T19:54:22.000Z",
"value": "Disclosed"
}
],
"title": "Datalogics Ecommerce Delivery \u003c= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-9613",
"datePublished": "2026-09-19T08:27:23.913Z",
"dateReserved": "2026-05-26T16:29:51.747Z",
"dateUpdated": "2026-09-19T13:51:18.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}