{"resultsPerPage":117,"startIndex":0,"totalResults":117,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-06T02:03:52.750","vulnerabilities":[{"cve":{"id":"CVE-2026-106013","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T02:17:01.303","lastModified":"2026-10-29T02:16:46.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causing the subsequent account/verify_credentials API call to remain signed with the site operator's stored Access Token and Access Token Secret rather than the authenticating visitor's token. This causes the X API to return the profile of the X application owner instead of the signing-in visitor, and the plugin then resolves and authenticates a WordPress account solely by matching that owner's email address via wp_set_auth_cookie(), allowing unauthenticated attackers to gain authenticated access as the WordPress user whose email corresponds to the X app owner, who is typically the site administrator."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"artbees","product":"Jupiter X Core","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.61.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:35:50.588966Z","id":"CVE-2026-106013","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3759312/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/classes/social-login-handler/twitter.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad42de2-9ed1-4cf6-a031-22789be4cbe2?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-107625","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T03:17:08.890","lastModified":"2026-10-28T17:17:32.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a visitor to click the attacker's Website URL link on their public Ultimate Member profile, a condition that is trivially met since the redirect-confirmation onclick handler is enabled by default on all new installations."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"ultimatemember","product":"Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.14.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:35:45.607186Z","id":"CVE-2026-107625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/ultimatemember/ultimatemember/releases/tag/2.14.1","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/includes/core/class-form.php#L896","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/includes/core/um-filters-fields.php#L519","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/includes/core/um-filters-fields.php#L522","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8180160d-ba33-4f79-baa5-2613be470b0f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-107745","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T03:17:09.037","lastModified":"2026-10-29T02:16:46.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"tigroumeow","product":"AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.8.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:32:09.199540Z","id":"CVE-2026-107745","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/api.php#L1040","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/api.php#L689","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/modules/files.php#L1071","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/modules/files.php#L470","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/modules/files.php#L62","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Fai-engine%2Ftags%2F3.8.4%2Fclasses%2Fmodules%2Ffiles.php&new_path=%2Fai-engine%2Ftags%2F3.8.5%2Fclasses%2Fmodules%2Ffiles.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4f8607c-711e-4d0e-8379-49346033a837?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109209","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T03:17:09.183","lastModified":"2026-10-29T02:16:46.660","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_fields[embedcode]' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is possible because the save_meta_data() handler returns early when $_POST['post_type'] is absent — a condition always true during XML-RPC requests — and the plugin unconditionally grants Subscribers the publish_aiovg_videos capability, making this exploitable by any authenticated user via a single wp.newPost XML-RPC call."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"plugins360","product":"All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.9.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:32:22.661683Z","id":"CVE-2026-109209","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.9.7/admin/videos.php#L254","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.9.7/includes/player/base.php#L1028","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.9.7/includes/player/base.php#L277","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3759353/all-in-one-video-gallery/trunk/includes/player/base.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc6b1fa7-d5f9-4aec-860e-067c26745450?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109974","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T03:17:09.490","lastModified":"2026-10-29T02:16:47.343","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"plugins360","product":"All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.9.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:32:27.444141Z","id":"CVE-2026-109974","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.9.7/includes/helpers/render.php#L457","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.9.7/public/videos.php#L56","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/tags/4.9.7/public/videos.php#L754","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3759353/all-in-one-video-gallery/trunk/includes/helpers/render.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97200206-e43d-403e-8aa1-4f11422385c6?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109999","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T03:17:09.630","lastModified":"2026-10-28T17:17:36.817","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires only that the chatbot module is active with at least one configured bot; the attacker stores the payload via three unauthenticated REST calls, and the JavaScript widget auto-poll then delivers it to any administrator who opens wp-admin/index.php."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"nalam-1","product":"AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.2.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T15:54:33.217378Z","id":"CVE-2026-109999","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ai-marketing-expert/tags/1.2.9","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-marketing-expert/trunk/assets/js/dashboard-widget.js#L240","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-marketing-expert/trunk/assets/js/dashboard-widget.js#L76","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-marketing-expert/trunk/assets/js/dashboard-widget.js#L92","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-marketing-expert/trunk/includes/admin/class-dashboard-widget.php#L210","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-marketing-expert/trunk/includes/admin/class-dashboard-widget.php#L616","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-marketing-expert/trunk/modules/chatbot/class-chatbot-rest-controller.php#L55","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-marketing-expert/trunk/modules/chatbot/controllers/class-public-controller.php#L410","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-marketing-expert/trunk/modules/chatbot/controllers/class-public-controller.php#L659","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9792f1aa-6137-4427-8f56-32d598fcc20d?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111314","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T03:17:09.817","lastModified":"2026-10-29T02:16:49.477","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkp_product_producturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation by unauthenticated attackers requires that the plugin's AJAX loading / AJAX handler option is enabled (atkp_options::get_ajax_loading_enabled() || get_ajax_handler_enabled()) and the attacker knows a product id to render. On a default installation, where that is not configured, the vulnerability requires attackers with contributor-level access and above."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"cservit","product":"affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.9.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:32:17.006452Z","id":"CVE-2026-111314","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/atkp_posttypes_product.php#L3183","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/basics/ATKPTools.php#L1470","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/helper/atkp_formatter.php#L2842","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/helper/atkp_formatter.php#L2895","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3759575%40affiliate-toolkit-starter&new=3759575%40affiliate-toolkit-starter","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ceea54-924a-41c1-a157-8eba24b5f666?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-84999","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T03:17:16.157","lastModified":"2026-10-29T02:16:53.910","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and wp_check_filetype_and_ext but never checking whether those validation calls produced errors before move_uploaded_file() is called, combined with no nonce or capability check on the AJAX handler. This makes it possible for unauthenticated attackers to upload files of dangerous types (e.g. PHP scripts) that may be executable, which makes remote code execution possible. The server returns the generated destination filename in the response, giving the attacker the exact path needed to trigger the uploaded file."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"Pie Register","product":"Pie Register Premium","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.8.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:35:34.731950Z","id":"CVE-2026-84999","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://pieregister.com/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8385dd30-28e5-4572-8504-2f3e7029bad6?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-97019","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T03:17:16.317","lastModified":"2026-10-29T02:16:55.690","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Subscriber-level user can store a malicious shortcode in their biographical info field; because WordPress core's wp_filter_kses() only strips HTML tags and not shortcode syntax, and because AMP content sanitizers run before do_shortcode() processes the archive description, the synthesized markup is never post-sanitized."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"mohammed_kaludi","product":"AMP for WP – Accelerated Mobile Pages","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.1.17","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:32:31.923315Z","id":"CVE-2026-97019","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.17/components/loop/loop.php#L69","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.17/includes/thirdparty-compatibility.php#L1565","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.17/includes/thirdparty-compatibility.php#L1594","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3722863%40accelerated-mobile-pages&new=3722863%40accelerated-mobile-pages","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be16349f-31aa-41b8-a4fa-95db3141ba9b?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111255","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T04:17:56.390","lastModified":"2026-10-28T17:17:38.683","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the \"import product image\" option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"cservit","product":"affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.9.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:58:23.798373Z","id":"CVE-2026-111255","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/atkp_posttypes_product.php#L3192","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/basics/ATKPTools.php#L546","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/basics/ATKPTools.php#L657","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/basics/ATKPTools.php#L710","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/dataservices/atkp_productservice.php#L775","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3759575%40affiliate-toolkit-starter&new=3759575%40affiliate-toolkit-starter","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/272a8ee4-8689-4935-89c5-e2f502621511?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111727","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T04:17:57.220","lastModified":"2026-10-29T02:16:49.703","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to be assigned as a calendar owner, a per-user grant that any administrator can extend to users as low as Subscriber level through the plugin's calendar list screen. Exploitation by attackers with subscriber-level access and above requires that an administrator has assigned the attacker's account as owner (`conwer`) of a calendar via the plugin's calendar list screen; the plugin's UI lists all registered users regardless of role, so a Subscriber can be assigned. On a default installation, where that is not configured, the vulnerability requires attackers with editor-level access and above."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"codepeople","product":"Appointment Booking Calendar","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.4.05","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:31:46.650451Z","id":"CVE-2026-111727","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.4.05/inc/cpabc_apps_go.inc.php#L102","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.4.05/inc/cpabc_apps_go.inc.php#L616","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.4.05/inc/cpabc_apps_go.inc.php#L690","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.4.05/inc/cpabc_apps_on.inc.php#L398","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.4.05/inc/cpabc_scheduler.inc.php#L194","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3750835/appointment-booking-calendar/trunk/inc/cpabc_scheduler.inc.php","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/log/appointment-booking-calendar/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd0e4753-222a-421f-a830-58f6af055dd8?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116613","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T04:17:57.390","lastModified":"2026-10-29T02:16:50.980","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching an arbitrary post by attacker-supplied ID and, in the 'publish' branch, calling displayContent() with no capability check and no validation that the post's post_type is the plugin's own CPT or is otherwise viewable (is_post_type_viewable()). This makes it possible for authenticated attackers, with Contributor-level access and above, to read the rendered block content of any published post, including posts of non-public custom post types (public=false, show_in_rest=false) that WordPress would otherwise hide from direct URLs and the REST API."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"bplugins","product":"Animated Text Block – Add Typing and Looping Text Effects","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.2.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:32:03.682310Z","id":"CVE-2026-116613","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/animated-text-block/tags/1.2.6/plugin.php#L132","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/animated-text-block/tags/1.2.6/plugin.php#L142","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/animated-text-block/tags/1.2.6/plugin.php#L163","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3767751%40animated-text-block&new=3767751%40animated-text-block","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7163be31-8f55-45ba-8364-e84a3e636d5b?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-1928","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T04:18:02.320","lastModified":"2026-10-29T02:16:51.953","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"rankmath","product":"Rank Math SEO – AI SEO Tools to Dominate SEO Rankings","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.0.276","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:31:53.118645Z","id":"CVE-2026-1928","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/modules/schema/class-db.php#L66","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/rest/class-sanitize.php#L110","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.263/includes/rest/class-shared.php#L446","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3666725/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4395be-7b4c-46b0-be00-7dedc6691f4a?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-103331","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:31.570","lastModified":"2026-11-05T11:16:38.577","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"UniPAY Payment Gateway For WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"2.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:51:06.716523Z","id":"CVE-2026-103331","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://wpscan.com/vulnerability/a7d61b5f-9e92-459c-8f6d-1c92ea94ef00/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-103372","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:31.900","lastModified":"2026-10-28T18:17:02.120","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Payconiq","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"1.0.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:50:55.618504Z","id":"CVE-2026-103372","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/19956956-b66f-47e6-9038-29d38283589a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-103382","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:32.020","lastModified":"2026-10-28T18:17:02.270","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Casso Flow  WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid, regardless of its payment method."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Casso Flow","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:50:45.585578Z","id":"CVE-2026-103382","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/2056019e-22bf-4ba1-9b3b-239a369f0219/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-103688","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:32.123","lastModified":"2026-10-28T18:17:02.417","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Checkout Files Upload for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:50:16.310569Z","id":"CVE-2026-103688","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://wpscan.com/vulnerability/08777aa1-6308-4e99-b2d0-5e43209aa6a6/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-104694","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:32.240","lastModified":"2026-10-28T18:17:02.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Thrive Automator","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"11.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:49:10.819094Z","id":"CVE-2026-104694","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ad8f60bb-ee1d-4472-92fa-e4e22fed1471/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-105972","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:32.353","lastModified":"2026-10-28T18:17:04.137","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out, allowing unauthenticated users to store a Cross-Site Scripting payload that can be delivered to and executed in the session of another user, including a logged-in administrator."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Menu Cart for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:48:58.718633Z","id":"CVE-2026-105972","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/579936d7-183f-4b25-acfd-b15f43eb573c/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-105997","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:32.467","lastModified":"2026-10-28T18:17:04.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Booking Package","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.7.33","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:48:44.923213Z","id":"CVE-2026-105997","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/59ceb45f-eb33-4103-bf75-d68b4f16e824/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-106002","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:32.577","lastModified":"2026-10-28T18:17:04.460","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Court Reservation  WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was scheduled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Court Reservation","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:48:29.986196Z","id":"CVE-2026-106002","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0f4186c3-a5b5-4b03-ba1f-2e2ce11c21dc/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-106003","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:32.680","lastModified":"2026-10-28T18:17:04.603","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Court Reservation  WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation  WordPress plugin before 1.12.4's configuration."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Court Reservation","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:48:18.035709Z","id":"CVE-2026-106003","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1aa4c6a3-e82a-44c2-a267-4f95b657a1aa/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-106647","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:32.787","lastModified":"2026-10-28T18:17:04.757","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Royal Addons for Elementor","defaultStatus":"unaffected","versions":[{"version":"1.3.68","lessThan":"1.7.1070","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","baseScore":3.8,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:48:03.787995Z","id":"CVE-2026-106647","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ec572544-dd52-48df-a62e-2edc03614ff4/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-107097","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:32.900","lastModified":"2026-10-28T18:17:05.023","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Royal Addons for Elementor","defaultStatus":"unaffected","versions":[{"version":"1.3.71","lessThan":"1.7.1070","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:47:52.926512Z","id":"CVE-2026-107097","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/57461fb8-4a81-47e6-aa91-44bde1993d9a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-107098","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:33.020","lastModified":"2026-10-28T18:17:05.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Royal Addons for Elementor","defaultStatus":"unaffected","versions":[{"version":"1.7.1037","lessThan":"1.7.1070","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:47:43.332340Z","id":"CVE-2026-107098","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/36a85589-3cf3-4e9c-85fd-e0896e92fc52/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-107100","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:33.133","lastModified":"2026-10-28T18:17:05.320","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content of posts stored in non-public post types, for example captured contact-form submissions containing names, email addresses and messages."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Royal Addons for Elementor","defaultStatus":"unaffected","versions":[{"version":"1.3.81","lessThan":"1.7.1070","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:47:34.363779Z","id":"CVE-2026-107100","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/12d7734c-ef28-445b-9625-5ba0271e9fa7/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-109236","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T06:16:33.237","lastModified":"2026-10-28T17:17:33.647","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the `authenticate_user_by_email_link()` function — hooked on the `wp` action and triggered by the `cusomer_email_verify` GET parameter — lacking any capability check or nonce verification, while the `secret_code` it validates is generated as `md5(email . time())` and the `verify_otp_nonce` required to trigger token issuance via the `wp_ajax_nopriv_resend_otp` handler is emitted to every front-end visitor through `wp_localize_script`. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's `customer_email_verified` meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the `cev_user_log` table to contain a `password` column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"zorem","product":"Customer Email Verification for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:35:52.578243Z","id":"CVE-2026-109236","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L119","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L151","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L274","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L580","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L616","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.3/includes/class-wc-customer-email-verification-signup.php","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/customer-email-verification-for-woocommerce/#developers","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e9fa74-5501-4429-a500-1d4199571a34?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-110292","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:33.437","lastModified":"2026-10-28T18:17:05.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"PayPlug for WooCommerce (Official)","defaultStatus":"unaffected","versions":[{"version":"2.9.0","lessThan":"3.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:47:22.333673Z","id":"CVE-2026-110292","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/91444324-4332-489e-9e97-f371d866c20c/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-110506","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:33.543","lastModified":"2026-10-28T18:17:05.970","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Page Builder by SiteOrigin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.38.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:46:19.426866Z","id":"CVE-2026-110506","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/20bbee29-928f-4503-9cef-69f204441c8e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-110507","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:33.657","lastModified":"2026-10-28T18:17:06.120","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft, pending, scheduled and private posts and pages."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Page Builder by SiteOrigin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.38.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:46:02.142899Z","id":"CVE-2026-110507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/613db16a-e1d2-4cdd-8c5c-e370634887a8/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-110509","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:33.760","lastModified":"2026-10-28T18:17:06.377","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Essential Addons for Elementor  WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on published posts."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Essential Addons for Elementor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.8.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:45:52.626056Z","id":"CVE-2026-110509","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/da6d12c7-e612-48de-9a57-9d41c36fd409/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-110524","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:33.870","lastModified":"2026-10-28T18:17:06.527","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Copy Anything to Clipboard for WordPress  WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view and interact with the content."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Copy Anything to Clipboard for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.5.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:45:41.433560Z","id":"CVE-2026-110524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/4ee29b7c-ae80-4875-bd78-7128ff4e5e1c/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-110691","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:33.973","lastModified":"2026-10-28T18:17:06.693","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPOrLogin  WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the login interface."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WPOrLogin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:45:10.876382Z","id":"CVE-2026-110691","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1a5731c4-1bca-4136-bfa8-37e30e86c588/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-111021","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:34.080","lastModified":"2026-10-28T18:17:06.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"افزونه پیامک ووکامرس | Persian WooCommerce SMS","defaultStatus":"unaffected","versions":[{"version":"7.2.0","lessThan":"7.3.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:44:52.403384Z","id":"CVE-2026-111021","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/4e5857fc-2984-4c8e-a519-ebd785932af1/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-111027","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:34.190","lastModified":"2026-10-28T18:17:07.013","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Welcart e-Commerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.12.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:44:35.510789Z","id":"CVE-2026-111027","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://wpscan.com/vulnerability/83de6994-0446-4944-abd5-50a0bbdf63f6/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-111031","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:34.293","lastModified":"2026-10-28T18:17:07.973","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Welcart e-Commerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.12.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:44:18.784750Z","id":"CVE-2026-111031","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7cb3af79-5295-4458-843b-b38e1c3fde25/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-111032","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:34.400","lastModified":"2026-10-28T18:17:08.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Welcart e-Commerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.12.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","baseScore":3.8,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:44:04.743495Z","id":"CVE-2026-111032","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wpscan.com/vulnerability/73a9a609-b647-4872-96d3-b066df0870ee/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-111577","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:34.507","lastModified":"2026-10-28T18:17:08.330","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The GoSMTP  WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP  WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"GoSMTP","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.2.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:43:51.377650Z","id":"CVE-2026-111577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://wpscan.com/vulnerability/8a20e9fd-9ed8-4984-b34a-2b29b4c8b133/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-111960","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:34.623","lastModified":"2026-10-28T18:17:08.480","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Royal MCP  WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP  WordPress plugin before 1.5.10."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Royal MCP","defaultStatus":"unaffected","versions":[{"version":"1.4.38","lessThan":"1.5.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:43:40.311352Z","id":"CVE-2026-111960","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wpscan.com/vulnerability/474153af-b440-4e89-a27b-131e94c4b63e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-111961","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:34.737","lastModified":"2026-10-28T18:17:08.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Royal MCP  WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Royal MCP","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.5.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","baseScore":3.8,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:43:16.163601Z","id":"CVE-2026-111961","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ffdf84e4-dce3-4768-91c9-138256c3064c/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-111967","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:34.843","lastModified":"2026-10-28T18:17:08.780","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MP3 Audio Player  WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MP3 Audio Player","defaultStatus":"unaffected","versions":[{"version":"5.9","lessThan":"5.16","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:43:05.697346Z","id":"CVE-2026-111967","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b0013531-eecd-4cbc-a0d2-2872384e6f3c/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-113485","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:34.957","lastModified":"2026-10-28T18:17:08.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Media Library Assistant","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.42","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:42:41.687390Z","id":"CVE-2026-113485","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d2705c60-8d84-4e96-89df-628cdc814058/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-113486","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:35.070","lastModified":"2026-10-28T18:17:09.140","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Media Library Assistant","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.42","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:42:27.298753Z","id":"CVE-2026-113486","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://wpscan.com/vulnerability/29f5c90d-564a-4844-bf8e-b72243da5a0a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-113487","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:35.180","lastModified":"2026-10-28T18:17:09.347","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The GeoDirectory  WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"GeoDirectory","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.196","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:42:15.626733Z","id":"CVE-2026-113487","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0117ed44-672d-4308-9fa0-0eb04fccd255/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-113488","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:35.287","lastModified":"2026-10-28T18:17:09.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The GeoDirectory  WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"GeoDirectory","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.196","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:41:55.499186Z","id":"CVE-2026-113488","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f228b40e-a0ca-46f0-8173-45e39958a69d/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-113494","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:35.393","lastModified":"2026-10-28T18:17:09.657","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The GeoDirectory  WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"GeoDirectory","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.195","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:41:44.787408Z","id":"CVE-2026-113494","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/29efa17c-fee7-4bd5-b52c-d0ce73bd786c/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-113813","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:35.503","lastModified":"2026-10-28T18:17:09.980","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"PayPlug for WooCommerce (Official)","defaultStatus":"unaffected","versions":[{"version":"2.8.0","lessThan":"3.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:41:27.421648Z","id":"CVE-2026-113813","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6decb385-7cc9-42d7-a079-0a96d1f697fc/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-115224","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:35.617","lastModified":"2026-10-28T18:17:11.633","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Customer Engagement System  WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Customer Engagement System","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:41:13.376287Z","id":"CVE-2026-115224","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://wpscan.com/vulnerability/de33decd-1ef2-436d-9372-60a3afccf618/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-115225","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:35.723","lastModified":"2026-10-28T18:17:11.780","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Customer Engagement System  WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Customer Engagement System","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:41:00.623697Z","id":"CVE-2026-115225","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b91dc5fc-8b7b-4874-9e71-e3d07b41812a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-115255","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:35.830","lastModified":"2026-10-28T18:17:11.933","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Roster","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.35","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:40:45.934509Z","id":"CVE-2026-115255","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/af573c89-e246-4c52-bd15-fa92c317c263/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-115281","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T06:16:35.930","lastModified":"2026-10-28T18:17:12.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Recipe Card Blocks Lite","defaultStatus":"unaffected","versions":[{"version":"3.5.0","lessThan":"3.6.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:40:34.650448Z","id":"CVE-2026-115281","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f358ccee-e664-4a0e-a2b9-d9710c8174ad/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-15323","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T06:16:36.043","lastModified":"2026-10-29T02:16:51.693","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process_checkout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The lumise_security nonce required to reach the vulnerable /?lumise=cart endpoint is freely obtainable by any unauthenticated visitor via the /?lumise=ajax action=init handler, making this exploitable with no prior access or credentials."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"King-Theme","product":"Product Designer for WooCommerce WordPress | Lumise","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.1.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:31:39.656264Z","id":"CVE-2026-15323","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/lumise/trunk/core/cart.php#L209","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a1fb57-84b2-4849-a4d5-9381baf43ff5?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-100175","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:42.883","lastModified":"2026-10-29T02:16:42.630","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all versions up to, and including, 1.9.87 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the ?postie=get-mail endpoint is reachable by unauthenticated users with no capability check, and the email processing path removes WordPress's kses output filters before saving raw markup, allowing the unescaped href attribute value to be stored as post content."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wayneallen-1","product":"Postie","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.9.87","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:30:23.578437Z","id":"CVE-2026-100175","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/lib/autolink.php#L129","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/lib/autolink.php#L136","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/lib/autolink.php#L220","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/postie-filters.php#L475","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/postie-message.php#L1311","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/postie-message.php#L607","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/postie.php#L241","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3751269","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b7d5d53-51a0-4d45-a180-0bde9edd8f4c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-103370","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:43.070","lastModified":"2026-10-29T02:16:45.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the \"Enable drag-n-drop uploader for ticket form\" setting is enabled, as it is disabled by default."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"awesomesupport","product":"Awesome Support – WordPress HelpDesk & Support Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:35:25.970203Z","id":"CVE-2026-103370","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.4.1/includes/file-uploader/class-file-uploader.php#L2032","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.4.1/includes/file-uploader/class-file-uploader.php#L2195","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.4.1/includes/file-uploader/class-file-uploader.php#L669","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3749553/awesome-support/trunk/includes/file-uploader/class-file-uploader.php","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/awesome-support/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01515533-197c-41c0-9c2b-6f0317cdc375?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-103996","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:43.223","lastModified":"2026-10-28T17:17:29.267","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically in the administrator's browser session, as the vulnerable branch only renders when an administrator previews or opens the post containing the crafted shortcode."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"ifso","product":"If-So Dynamic Content – Elementor & All Page Builders Personalization","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.10.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:35:59.368233Z","id":"CVE-2026-103996","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/extensions/ifso-extended-shortcodes/extended-shortcodes.php#L455","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/extensions/ifso-extended-shortcodes/extended-shortcodes.php#L469","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3748902%40if-so&new=3748902%40if-so","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/177aca03-683b-48e1-911f-c966b171626b?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-104729","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:43.370","lastModified":"2026-10-29T02:16:45.810","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post does not strip the payload on save because the dangerous characters reside within shortcode attribute text between square brackets, which kses treats as plain text rather than HTML markup."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"themefusion","product":"Avada (Fusion) Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.16.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:30:18.638453Z","id":"CVE-2026-104729","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://avada.com/blog/version-7-16-3-security-update/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/650d346d-c30a-4ee1-ac50-6a264e181174?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-104740","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:43.513","lastModified":"2026-10-29T02:16:45.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'conversion' Shortcode Attribute in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"ifso","product":"If-So Dynamic Content – Elementor & All Page Builders Personalization","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.10.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:30:51.466444Z","id":"CVE-2026-104740","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/extensions/ifso-extended-shortcodes/extended-shortcodes.php#L258","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/extensions/ifso-extended-shortcodes/extended-shortcodes.php#L267","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3748902/if-so/trunk/extensions/ifso-extended-shortcodes/extended-shortcodes.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3673560a-6f72-42ea-8b0d-f866dca33638?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-104743","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:43.653","lastModified":"2026-10-29T02:16:46.037","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmp_file' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The poisoned importer path is persisted to the database and later triggered via a separate GET request to the /source_info endpoint, which passes the attacker-controlled path to fopen() and fgetcsv() and returns parsed file contents in the REST response."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"tainacan","product":"Tainacan","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:29:15.756406Z","id":"CVE-2026-104743","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/tainacan/tainacan/commit/1cc2c179d213670ae4bd378473d6fecbc35c6357","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-importers-controller.php#L146","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-importers-controller.php#L190","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-importers-controller.php#L223","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-importers-controller.php#L266","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/background-process/importer/class-tainacan-csv.php#L334","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/background-process/importer/class-tainacan-csv.php#L36","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/background-process/importer/class-tainacan-csv.php#L93","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/background-process/importer/class-tainacan-importer.php#L255","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tainacan/tags/1.4.0/classes/api/endpoints/class-tainacan-rest-importers-controller.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e16bda6d-0818-468b-9114-82a8f5f68caf?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-107710","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:43.810","lastModified":"2026-10-28T16:17:00.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpmudev","product":"Hustle – Email Marketing, Lead Generation, Optins, Popups","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.8.14.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:36:38.020063Z","id":"CVE-2026-107710","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/front/hustle-module-front.php#L917","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/front/hustle-module-renderer.php#L163","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/front/hustle-module-renderer.php#L181","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/hustle-module-model.php#L569","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/hustle-modules-common-admin-ajax.php#L49","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3758337/wordpress-popup/trunk/inc/front/hustle-module-renderer.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3ed1a2a-f9d5-4f34-8a8e-583ea7226df8?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-108366","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:43.963","lastModified":"2026-10-29T02:16:46.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the 'icon' attribute of the easyjobs/job-list Gutenberg block in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpdevteam","product":"easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:33:39.178265Z","id":"CVE-2026-108366","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/easyjobs/tags/2.8.0/blocks/includes/class-scripts.php#L245","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/easyjobs/tags/2.8.0/includes/class-easyjobs-helper.php#L1612","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/easyjobs/tags/2.8.0/public/partials-blocks/default/list.php#L21","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/easyjobs/tags/2.8.2/blocks/includes/class-scripts.php#L245","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/easyjobs/tags/2.8.2/includes/class-easyjobs-helper.php#L1612","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/easyjobs/tags/2.8.2/public/partials-blocks/default/list.php#L21","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3745995/easyjobs/trunk/public/partials-blocks/default/list.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9314454b-c790-44a5-90bb-1c38bd75b23f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109218","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:44.120","lastModified":"2026-10-29T02:16:46.770","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"kleor","product":"Contact Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"9.1.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:29:48.595341Z","id":"CVE-2026-109218","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://fr.wordpress.org/plugins/contact-manager/","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/contact-manager.php#L42","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/add-message.php#L254","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/add-message.php#L256","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/forms/processing.php#L102","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3767815%40contact-manager%2Ftags%2F9.1.3&old=3661172%40contact-manager%2Ftags%2F9.1.2","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b359ef59-4c2e-4d4e-b000-1845525131de?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109370","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:44.270","lastModified":"2026-10-29T02:16:46.883","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is triggered specifically when the victim clicks the embedded document's Download button, which causes the de_track_download AJAX fallback path to programmatically create an anchor with the attacker-controlled href and call .click() — a condition reached because supplying docId=0 causes can_read_document() to return false, bypassing the normal download flow."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"bplugins","product":"Document Embedder – let visitors read files without downloading","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:32:52.767202Z","id":"CVE-2026-109370","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/document-emberdder/tags/2.4.0/build/blocks/document-embed/render.php#L92","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/document-emberdder/tags/2.4.0/build/blocks/document-embed/view.js","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/document-emberdder/tags/2.4.0/includes/core/class-bplde-helper-functions.php#L182","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/document-emberdder/tags/2.4.0/includes/features/class-bplde-ajaxcall.php#L289","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3751444/document-emberdder/trunk","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3751444%40document-emberdder%2Ftags%2F2.4.1&old=3731835%40document-emberdder%2Ftags%2F2.4.0","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad7f7459-943f-42de-b14a-34c8c24763e1?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109381","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:44.423","lastModified":"2026-10-28T17:17:34.973","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"magepeopleteam","product":"Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.7.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:58:25.891058Z","id":"CVE-2026-109381","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/magepeopleteam/mage-eventpress","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/woocommerce-event-press.php#L405","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/woocommerce-event-press.php#L432","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/woocommerce-event-press.php#L504","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3754150/mage-eventpress/trunk/woocommerce-event-press.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/076607ec-d848-4b4e-986b-31287f8f0ae4?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109384","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:44.570","lastModified":"2026-10-29T02:16:46.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the allowed-extensions sanitizer and deliberate override of WordPress's native MIME and extension defences via a registered wp_check_filetype_and_ext filter. This makes it possible for authenticated attackers, with custom-level access and above, to upload files that may be executable, which makes remote code execution possible. An authenticated attacker with the custom add_edit_forms capability must first configure a File Upload field with a dangerous extension (e.g., php) in the allowed-extensions list; once that form is published, any unauthenticated visitor can trigger the actual file upload via the publicly accessible /wp-json/ivyforms/v1/form/submission/ REST route."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"melograno","product":"The Innovative Form Builder – IvyForms","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.5.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:30:32.427822Z","id":"CVE-2026-109384","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ivyforms/tags/1.5.1/backend/src/Common/Sanitizer/Sanitizer.php#L839","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ivyforms/tags/1.5.1/backend/src/Routes/Form/Form.php#L246","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ivyforms/tags/1.5.1/backend/src/Services/Submission/SubmissionUploadFilePersister.php#L126","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ivyforms/tags/1.5.1/backend/src/Services/Submission/SubmissionUploadFileValidator.php#L127","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ivyforms/tags/1.5.1/backend/src/Services/Submission/SubmissionUploadFiletypeFilter.php#L68","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3757861%40ivyforms&new=3757861%40ivyforms","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52ca2269-a7f4-477c-bacd-0321ad09e679?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109385","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:44.720","lastModified":"2026-10-29T02:16:47.113","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][slot_{N}_link][url]' parameter in all versions up to, and including, 5.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected javascript: payload fires on click rather than on page load, making exploitation contingent on a privileged user such as an Editor or Administrator clicking the attacker-crafted link while reviewing or previewing the Contributor's post."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"posimyththemes","product":"UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:35:15.911349Z","id":"CVE-2026-109385","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/uichemy/tags/5.2.5/uichemy-composer/includes/admin/class-uichemy-composer-manager.php#L3746","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/uichemy/tags/5.2.5/uichemy-composer/includes/admin/widgets/class-uichemy-composer-widget.php#L1428","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/uichemy/tags/5.2.5/uichemy-composer/includes/admin/widgets/class-uichemy-composer-widget.php#L3580","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/uichemy/tags/5.2.5/uichemy-composer/includes/admin/widgets/class-uichemy-composer-widget.php#L476","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3754473/uichemy/trunk/uichemy-composer/includes/admin/widgets/class-uichemy-composer-widget.php","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/uichemy/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fdc5c50-1d5b-4141-9524-f0e01c097a87?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109590","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:44.867","lastModified":"2026-10-29T02:16:47.233","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user supplied attributes in the ttbm_hotel_map_shortcode() function, which concatenates the raw attribute values into double-quoted HTML attributes of an <iframe> tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"magepeopleteam","product":"Travelly – Tour & Travel Booking Manager for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.3.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:35:12.190161Z","id":"CVE-2026-109590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/magepeopleteam/tour-booking-manager","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tour-booking-manager/tags/2.3.6/inc/TTBM_Shortcodes.php#L76","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tour-booking-manager/tags/2.3.6/inc/TTBM_Shortcodes.php#L91","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3757674/tour-booking-manager/trunk/inc/TTBM_Shortcodes.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2100f72a-ff75-4429-8dc6-be5b6e3c84cb?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109972","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:45.017","lastModified":"2026-10-28T17:17:35.900","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, <= 261011 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post() on save because it contains no literal angle brackets — only backslash-escaped sequences that PHP's date() materializes into HTML tag characters at render time after WordPress's shortcode_parse_atts() applies stripcslashes() to the attribute value."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"clavaque","product":"s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"261011","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:36:07.974395Z","id":"CVE-2026-109972","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-gets-in.inc.php#L119","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-gets-in.inc.php#L53","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-gets-in.inc.php#L98","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/codes.inc.php#L24","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3751344/s2member/trunk/src/includes/classes/sc-gets-in.inc.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2782f0f7-625d-4141-8e2c-4bdaa0219007?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109975","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:45.163","lastModified":"2026-10-29T02:16:47.467","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied on save, it does not neutralize a quote-only attribute-breakout payload containing no '<' character, leaving the block comment and its decoded JSON attributes intact and exploitable at render time."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"cozythemes","product":"Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.2.27","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:28:50.750954Z","id":"CVE-2026-109975","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/block.json#L777","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/render.php#L927","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/render.php#L929","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/render.php#L935","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/featured-product-tabs/render.php#L943","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3752142%40cozy-addons&new=3752142%40cozy-addons","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4041795-8131-459f-9156-5ecf5d6086f6?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109978","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:45.313","lastModified":"2026-10-29T02:16:47.583","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reached when the productRating option is enabled and the associated WooCommerce product has a non-zero rating."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"cozythemes","product":"Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.2.27","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:34:14.786377Z","id":"CVE-2026-109978","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/product-tab/render.php#L934","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cozy-addons/tags/2.2.27/blocks/product-tab/render.php#L936","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3752142%40cozy-addons&new=3752142%40cozy-addons","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33e9f3e2-2631-4c8d-b705-6bb592a1f7a3?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109979","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:45.453","lastModified":"2026-10-29T02:16:47.690","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wp_create_link' parameter of the hidden 'rp4wp_link_related' admin page. The handle_create_link() handler verifies the nonce and that the current user can edit the parent post, but never checks that the attacker-supplied child post ID is one the user is allowed to read; LinkRepository::insert() stores the arbitrary child ID without validation, and ManageLinks::render() later calls LinkRepository::get_children() in its no-extra-args fast path, which falls through to array_map('get_post', $child_ids) — bypassing read_private_posts/read_post capability checks — and then echoes esc_html($child->post_title) in the parent's editor meta box. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the titles of arbitrary non-public posts (drafts, pending, private, future, trashed) authored by higher-privileged users by linking those post IDs to a draft they own and then reading the resulting meta box."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"barrykooij","product":"Related Posts for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:31:24.070404Z","id":"CVE-2026-109979","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/related-posts-for-wp/tags/3.0.0/src/Admin/LinkScreen/Page.php#L164","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/related-posts-for-wp/tags/3.0.0/src/Admin/MetaBox/ManageLinks.php#L98","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/related-posts-for-wp/tags/3.0.0/src/Links/LinkRepository.php#L310","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/related-posts-for-wp/tags/3.0.0/src/Links/LinkRepository.php#L86","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3757484/related-posts-for-wp/trunk/src/Admin/LinkScreen/Page.php","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3757484%40related-posts-for-wp&new=3757484%40related-posts-for-wp","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ab9af6a-bfe7-4da5-8e60-b20f38cbab36?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109980","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:45.603","lastModified":"2026-10-28T16:17:00.453","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wp_view' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and publication dates of all private posts site-wide, normally restricted to Editor-level users and above. The page's existing authorization check only verifies edit_posts and edit_post on a parent post the attacker owns, both of which any Contributor satisfies, leaving no effective gate against reading other authors' private posts."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"barrykooij","product":"Related Posts for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:36:21.286570Z","id":"CVE-2026-109980","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/related-posts-for-wp/tags/3.0.0/src/Admin/LinkScreen/ListTable.php#L169","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/related-posts-for-wp/tags/3.0.0/src/Admin/LinkScreen/ListTable.php#L357","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/related-posts-for-wp/tags/3.0.0/src/Admin/LinkScreen/Page.php#L107","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/related-posts-for-wp/tags/3.0.0/src/Admin/LinkScreen/Page.php#L286","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3757484%40related-posts-for-wp&new=3757484%40related-posts-for-wp","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c197521-6e8d-4cdc-b4a3-0c165ea5ff6a?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109988","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:45.747","lastModified":"2026-10-29T02:16:47.803","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"acowebs","product":"Product Addons for Woocommerce – Product Options with Custom Fields","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.1.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:33:20.718345Z","id":"CVE-2026-109988","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/includes/backend/api.php#L237","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/includes/helper.php#L284","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/includes/process/cart.php#L109","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/includes/process/process.php#L262","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/templates/cart/cart-item-data.php#L14","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3756829/woo-custom-product-addons/trunk/templates/cart/cart-item-data.php","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/woo-custom-product-addons/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99c24e6f-396a-45bd-b16e-cb3b30aff25c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-110020","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:45.897","lastModified":"2026-10-29T02:16:48.757","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve the plugin's 127-character site-wide grw_auth_code authentication secret and use it to impersonate the WordPress site to the RichPlugins backend service at app.richplugins.com."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"widgetpack","product":"Rich Showcase for Google Reviews","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.1.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:31:02.976167Z","id":"CVE-2026-110020","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://downloads.wordpress.org/plugin/widget-google-reviews.7.1.7.zip","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.6/includes/admin/class-admin-menu.php#L78","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.6/includes/class-builder-page.php#L193","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.6/includes/class-builder-page.php#L71","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcf9640-ef7e-4cff-ada2-5ddc4261befa?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-110071","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:46.057","lastModified":"2026-10-29T02:16:48.877","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the payload contains no angle brackets, wp_kses_post leaves the shortcode intact on save, allowing the malicious attribute value to survive post submission and fire in any viewer's browser — including an administrator previewing a pending post."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"kitae-park","product":"Mang Board","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.4.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:33:53.789429Z","id":"CVE-2026-110071","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.5/includes/functions/func.template.php#L214","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.5/includes/mb-actions.php#L632","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.5/includes/mb-actions.php#L638","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.6/includes/mb-actions.php","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/mangboard/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c90d09-3673-4298-9c54-c3fe1edf6c09?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-110185","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:46.203","lastModified":"2026-10-28T16:17:00.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image (any body field referenced by the ImageHelper node's mix tag)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires that an administrator has built a webhook-triggered flow that pipes a webhook body field into an ImageHelper imageToBase64 node, and that the webhook remains in its default configuration (no bearer secret enforced, no IP allowlist set) — a legitimate and documented use case."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"bitpressadmin","product":"Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.31.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:36:40.336080Z","id":"CVE-2026-110185","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-98"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/bit-pi/tags/1.31.0/backend/app/HTTP/Controllers/WebhookDispatchController.php#L144","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bit-pi/tags/1.31.0/backend/app/Helpers/Utility.php#L108","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bit-pi/tags/1.31.0/backend/app/src/Tools/ImageHelper/ImageHelperTool.php#L192","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bit-pi/tags/1.31.0/backend/app/src/Tools/ImageHelper/ImageHelperTool.php#L492","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bit-pi/tags/1.31.0/backend/app/src/Tools/ImageHelper/ImageHelperTool.php#L58","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bit-pi/tags/1.31.0/backend/hooks/api.php#L13","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bit-pi/tags/1.32.0/backend/app/src/Tools/ImageHelper/ImageHelperTool.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7ae89c1-d128-4b0c-ae70-69b0cd219382?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-110662","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:46.357","lastModified":"2026-10-29T02:16:48.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload is written by any unauthenticated visitor via a single POST to admin-ajax.php and detonates automatically when any administrator next loads the Transcripts page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"mxchat","product":"MxChat – AI Chatbot & Content Generation for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.2.25","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:35:19.746850Z","id":"CVE-2026-110662","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/3.2.25/includes/class-mxchat-admin.php#L3824","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/3.2.25/js/mxchat_transcripts.js#L1252","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/3.2.25/js/mxchat_transcripts.js#L267","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/3.2.25/js/mxchat_transcripts.js#L427","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/3.2.25/mxchat-basic.php#L2340","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3751971/mxchat-basic/trunk/js/mxchat_transcripts.js","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b284bf9-8720-4417-9433-be147b06023a?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111068","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:46.517","lastModified":"2026-10-29T02:16:49.117","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to run the plugin's block-conversion migration (\"Scan & Convert Blocks\" during deactivation), which triggers the vulnerable build_group_block() function and promotes the dormant payload from a block delimiter comment into live post_content HTML. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"justinnealey","product":"DesignSetGo","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:34:08.771423Z","id":"CVE-2026-111068","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/jnealey-godaddy/designsetgo/pull/659","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/designsetgo/tags/2.11.0/includes/admin/class-block-migrator.php#L1134","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/designsetgo/tags/2.11.0/includes/admin/class-block-migrator.php#L1229","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/designsetgo/tags/2.11.0/includes/admin/class-block-migrator.php#L144","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3762066/designsetgo/trunk/includes/admin/class-block-migrator.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2314df91-4e0a-4c8b-8f8e-8b8ae1b88524?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111111","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:46.680","lastModified":"2026-10-29T02:16:49.230","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because core wp_filter_kses leaves the submitted markup inert, but the plugin's subsequent regex fallback consumes closing quotes of allowed attribute values containing 'bdt-', promoting previously inert bytes — such as event handlers like onfocus — into real HTML attributes that are then written to the database and rendered without further sanitization."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"bdthemes","product":"Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.7.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:33:58.362458Z","id":"CVE-2026-111111","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/tags/4.7.2/includes/class-content-guard.php#L128","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/tags/4.7.2/includes/class-content-guard.php#L292","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/tags/4.7.2/includes/class-content-guard.php#L329","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/tags/4.7.2/includes/class-content-guard.php#L59","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/tags/4.7.2/loader.php#L133","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3752580/bdthemes-prime-slider-lite/trunk/includes/class-content-guard.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/918dd473-dbe7-4352-95e9-3f705b09a4f2?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111120","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:46.837","lastModified":"2026-10-28T16:17:01.273","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal <?php...?> payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"e4jvikwp","product":"VikRentCar Car Rental Management System","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.4.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:58:28.087785Z","id":"CVE-2026-111120","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/controller.php#L9558","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/controller.php#L9609","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/helpers/conditional_rules.php#L1003","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/helpers/conditional_rules.php#L654","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/helpers/conditional_rules.php#L765","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/site/helpers/lib.vikrentcar.php#L2685","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3755596%40vikrentcar&new=3755596%40vikrentcar","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36f84246-6658-407a-88dd-4b99a784e682?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111213","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:46.990","lastModified":"2026-10-29T02:16:49.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to duplicate arbitrary posts — including private, draft, and pending posts authored by Administrators and Editors — into drafts they own, thereby exposing the original post's content, excerpt, title, taxonomies, and metadata. A Contributor can harvest a valid nonce from the Duplicate row-action on their own posts list and reuse it against any victim post ID, since the nonce action is the static string 'TTBM_Admin.php' and is not bound to any specific post."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"magepeopleteam","product":"Travelly – Tour & Travel Booking Manager for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.3.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:30:12.595953Z","id":"CVE-2026-111213","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/magepeopleteam/tour-booking-manager","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tour-booking-manager/tags/2.3.6/admin/TTBM_Admin.php#L100","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tour-booking-manager/tags/2.3.6/admin/TTBM_Admin.php#L103","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/tour-booking-manager/tags/2.3.6/admin/TTBM_Admin.php#L178","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3757674/tour-booking-manager/trunk/admin/TTBM_Admin.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/870a0989-03ce-4c71-86a5-2e536bfadbc0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111372","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:47.137","lastModified":"2026-10-29T02:16:49.593","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeatedly trigger RAG document sync operations that issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key, draining their AI API credits and causing financial loss. The wp_chatbot nonce required to reach this endpoint is emitted to every authenticated frontend visitor via wp_localize_script, making it trivially obtainable by any subscriber-level account."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"quantumcloud","product":"AI ChatBot for WooCommerce – WoowBot","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:30:45.946511Z","id":"CVE-2026-111372","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/woowbot-woocommerce-chatbot/tags/5.0.0/includes/class-qcld-bot-rag.php#L27","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woowbot-woocommerce-chatbot/tags/5.0.0/includes/class-qcld-bot-rag.php#L816","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woowbot-woocommerce-chatbot/tags/5.0.0/qcld-woowbot.php#L331","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woowbot-woocommerce-chatbot/tags/5.0.1/includes/class-qcld-bot-rag.php#L816","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3408f728-48e9-4f96-98d4-748f51686e26?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116609","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:47.287","lastModified":"2026-10-29T02:16:50.870","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsm_showTrafficStatsList] shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the user-supplied attribute and lack of sufficient preparation on the existing SQL query: `shortcode_atts()` returns attacker-supplied shortcode attributes verbatim (WP core performs no sanitization), only `$atts['id']` is re-sanitized afterward, and the raw value is then concatenated into a double-quoted SQL string literal inside `fnGetHourlyReportByDateNameTimeZone()` (`includes/wsm_db.php:1449`) and executed via `$wpdb->get_results()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"osamaesh","product":"WP Visitor Statistics (Real Time Traffic)","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"8.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:30:40.011408Z","id":"CVE-2026-116609","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.8/includes/wsm_db.php#L1449","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.8/includes/wsm_db.php#L1629","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.8/includes/wsm_statistics.php#L1980","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-stats-manager/tags/8.8/includes/wsm_statistics.php#L2002","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3768203/wp-stats-manager/trunk/includes/wsm_db.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00dbb2e7-5989-4fb9-b30b-ee582bf39e3f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116610","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:47.450","lastModified":"2026-10-28T16:17:06.660","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the plugin's cl_login_url/cl_login_id/cl_register_url/cl_register_id/cl_restore_url/cl_restore_id/cl_edit_url/cl_edit_id/cl_change_password_url/cl_change_password_id options with the ID and permalink of a post they themselves authored — simply by embedding the plugin's shortcodes in their own post content."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"hornero","product":"Clean Login","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.20.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:36:31.550907Z","id":"CVE-2026-116610","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/clean-login/tags/1.20.1/include/shortcodes.php#L14","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/clean-login/tags/1.20.1/include/shortcodes.php#L262","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3768058/clean-login","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3768058/clean-login/trunk/include/shortcodes.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83a8c282-8552-420d-842f-acd235ad61b8?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116749","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:47.610","lastModified":"2026-10-29T02:16:51.117","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() applied at save time does not neutralize the payload because the injection lands in an HTML-attribute context where only a raw double-quote is needed to break out, and block-comment JSON encoding of that quote is decoded back to a literal character by do_blocks() at render time."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"e4jvikwp","product":"VikRentCar Car Rental Management System","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.4.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:30:04.986479Z","id":"CVE-2026-116749","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.10/libraries/adapter/module/widget.php#L191","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.10/libraries/adapter/module/widget.php#L910","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.11/libraries/adapter/module/widget.php#L196","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/775a8904-0c6a-4968-8efb-b6ef1a599818?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116750","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:47.753","lastModified":"2026-10-29T02:16:51.230","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can store a malicious block via the REST API in a pending post and trigger server-side rendering by previewing that post, bypassing wp_magic_quotes since the attribute is sourced from post_content via parse_blocks rather than a superglobal."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"e4jvikwp","product":"VikRentCar Car Rental Management System","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.4.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:29:28.702473Z","id":"CVE-2026-116750","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.10/libraries/adapter/module/widget.php#L900","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.10/modules/mod_vikrentcar_cars/helper.php#L95","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.11/modules/mod_vikrentcar_cars/helper.php#L98","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c956f1d0-f3fc-4da2-b6d8-3a294a033f3c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116761","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:47.893","lastModified":"2026-10-29T02:16:51.337","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field inside group — field id controlled by integrator config)' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when a site integrator renders the plugin's documented front-end form helper with a wysiwyg field inside a repeatable group on a publicly accessible page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"jtsternberg","product":"CMB2","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.13.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:33:34.211862Z","id":"CVE-2026-116761","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/CMB2/CMB2/commit/fbeb7c4688dc5b8635a34978d837f1d458dcac44","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cmb2/tags/2.13.4/includes/CMB2_Field.php#L715","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cmb2/tags/2.13.4/includes/CMB2_Sanitize.php#L447","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cmb2/tags/2.13.4/includes/helper-functions.php#L320","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cmb2/tags/2.13.4/includes/types/CMB2_Type_Wysiwyg.php#L93","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3767609/cmb2/trunk/includes/CMB2_Field.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97215367-08c0-46cc-a595-4475274a5a1c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-118164","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:48.050","lastModified":"2026-10-28T16:17:07.270","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repeater[*][version_uid] (and many sibling fields: freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom, …)' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"ifso","product":"If-So Dynamic Content – Elementor & All Page Builders Personalization","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.10.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:36:14.082990Z","id":"CVE-2026-118164","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/admin/class-if-so-admin.php#L104","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/admin/class-if-so-settings.php#L726","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/admin/class-if-so-settings.php#L747","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/admin/partials/ifso_trigger_settings_metabox.php#L356","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/admin/partials/ifso_trigger_settings_metabox.php#L371","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/if-so/tags/1.10.2/admin/partials/ifso_trigger_settings_metabox.php#L392","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3748902/if-so/trunk/admin/partials/ifso_trigger_settings_metabox.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5df83f52-b976-4f60-b48d-d76b1ce2af9f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-118169","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:48.213","lastModified":"2026-10-29T02:16:51.577","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[cta_label]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default only Administrators hold the hustle_edit_module capability, but the plugin's built-in Permissions screen allows administrators to delegate this capability to lower roles including Subscriber, enabling Subscriber-level exploitation on sites where that delegation has been configured."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpmudev","product":"Hustle – Email Marketing, Lead Generation, Optins, Popups","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.8.14.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:29:21.761190Z","id":"CVE-2026-118169","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/front/hustle-module-renderer.php#L479","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/front/hustle-module-renderer.php#L500","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/hustle-module-model.php#L574","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/hustle-modules-common-admin-ajax.php#L56","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.4/inc/front/hustle-module-renderer.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e212b92a-e5f4-415d-9205-070fe720a687?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-2839","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:48.367","lastModified":"2026-10-29T02:16:52.227","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users (`wp_ajax_nopriv_*`) that fail to implement proper `current_user_can()` authorization checks. While these handlers use ACF's `acf_verify_ajax()` function to validate cryptographic nonces, the `acf_nonce` values are generated for guest users and publicly exposed in the page source of any frontend page utilizing an ACF form. This makes it possible for unauthenticated attackers to extract the guest nonce and bypass WordPress visibility permissions, leading to the unauthorized disclosure of post titles and internal Flexible Content layout structures. The vulnerability was partially patched in version 0.9.2.4."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"hwk-fr","product":"Advanced Custom Fields: Extended","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"0.9.2.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:33:28.630428Z","id":"CVE-2026-2839","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/acf-extended/trunk/includes/fields/field-advanced-link.php#L25","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acf-extended/trunk/includes/fields/field-advanced-link.php#L603","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acf-extended/trunk/includes/fields/field-flexible-content-async.php#L151","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acf-extended/trunk/includes/fields/field-flexible-content-async.php#L24","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3516027/","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3754818/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9954ef37-bae0-48fb-9654-ff54750c46c2?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-76005","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:48.707","lastModified":"2026-10-29T02:16:53.437","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be exploited by a Contributor via the [wpinventory_categories] shortcode embedded in a draft post rendered through preview, without requiring the post to be published."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"chuck1982","product":"WP Inventory Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.5.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:28:59.710419Z","id":"CVE-2026-76005","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.0/includes/wpinventory.category.class.php#L78","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.0/includes/wpinventory.shortcodes.class.php#L107","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.0/includes/wpinventory.shortcodes.class.php#L38","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.1/includes/wpinventory.category.class.php#L78","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.1/includes/wpinventory.shortcodes.class.php#L107","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-inventory-manager/tags/2.5.1/includes/wpinventory.shortcodes.class.php#L38","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3712512%40wp-inventory-manager&new=3712512%40wp-inventory-manager","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0682bf7-0b5a-402f-9ae0-34e2f0f65bcf?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-76058","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:48.880","lastModified":"2026-10-28T16:17:08.930","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disable or enable the PayPal Brasil BCDC payment gateway and overwrite its WooCommerce gateway settings, removing PayPal from checkout for all customers."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"odefranca","product":"PayPal Brasil para WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.7.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T15:54:35.858312Z","id":"CVE-2026-76058","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/paypal-brasil-para-woocommerce/tags/1.7.5/includes/handlers/api/class-paypal-brasil-api-ppp-activate.php#L45","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/paypal-brasil-para-woocommerce/tags/1.7.5/includes/handlers/api/class-paypal-brasil-bcdc-activate.php#L46","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/paypal-brasil-para-woocommerce/tags/1.7.5/includes/handlers/api/class-paypal-brasil-bcdc-activate.php#L64","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/paypal-brasil-para-woocommerce/tags/1.7.5/includes/handlers/class-paypal-brasil-handler.php#L55","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3744502%40paypal-brasil-para-woocommerce&new=3744502%40paypal-brasil-para-woocommerce","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa13ee0-0aee-4929-9bd0-a1375e002d26?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-76780","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:49.060","lastModified":"2026-10-29T02:16:53.563","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoach_write_redirectManager' (and sibling rankingcoach_write_* module capabilities) to the Contributor role via BaseModule::defineCapabilities(), whose default role list includes 'contributor', combined with the module's REST endpoints (registered through BaseSubmoduleApi::registerRouteCreate/registerRouteEdit/registerRouteDelete) authorizing state-changing requests solely through checkPermissionsPost(), which only calls current_user_can('rankingcoach_write_<module>') and performs no admin capability, ownership, or additional nonce check inside the callback. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to effectively that of an Administrator with respect to site-wide redirect management — creating, updating, or deleting 301/302 redirects that RedirectManagerHooks::handleRedirects() executes for every frontend visitor on template_redirect, allowing hijacking of arbitrary paths (including /checkout, /wp-login."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"rankingcoach","product":"BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.3.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:29:55.814453Z","id":"CVE-2026-76780","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleBase/BaseModule.php#L249","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleBase/BaseSubmoduleApi.php#L289","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleLibrary/Links/RedirectManager/RedirectManager.php#L67","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleLibrary/Links/RedirectManager/RedirectManagerApi.php#L266","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/beyondseo/tags/1.3.1/inc/Modules/ModuleLibrary/Links/RedirectManager/RedirectManagerHooks.php#L51","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3722492%40beyondseo&new=3722492%40beyondseo","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd4b2396-288f-45e6-b911-b017dc8d0526?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-77188","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:49.223","lastModified":"2026-10-29T02:16:53.677","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'type' Shortcode Attribute in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied on contributor post save does not prevent this vulnerability because shortcode attribute values are not HTML and pass through kses unchanged; the payload is materialized only at render time when the shortcode is expanded."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"xootix","product":"Waitlist Woocommerce ( Back in stock notifier )","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:31:15.338494Z","id":"CVE-2026-77188","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/waitlist-woocommerce/tags/2.9.0/includes/xoo-wl-functions.php#L114","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/waitlist-woocommerce/tags/2.9.0/includes/xoo-wl-functions.php#L155","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/waitlist-woocommerce/tags/2.9.0/includes/xoo-wl-functions.php#L170","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3765571/waitlist-woocommerce/trunk/includes/xoo-wl-functions.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41348b65-97d7-467f-801f-a168eb366bba?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-77871","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:49.377","lastModified":"2026-10-29T02:16:53.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Entity-encoded payloads such as &lt;script&gt;...&lt;/script&gt; survive WordPress's wp_kses_post on-save sanitization because kses does not decode HTML entities, and are only converted back into executable HTML tags at render time by the plugin's own shortcode filter. This requires snippet shortcodes to be enabled."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"saadiqbal","product":"Post Snippets – Custom WordPress Code Snippets Customizer","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.2.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:33:15.822523Z","id":"CVE-2026-77871","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.2.3/src/PostSnippets/Shortcode.php#L140","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.2.3/src/PostSnippets/Shortcode.php#L183","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.2.3/src/PostSnippets/Shortcode.php#L29","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.2.3/src/PostSnippets/Shortcode.php#L70","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.2.4/src/PostSnippets/Shortcode.php#L140","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.2.4/src/PostSnippets/Shortcode.php#L183","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.2.4/src/PostSnippets/Shortcode.php#L29","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.2.4/src/PostSnippets/Shortcode.php#L70","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3759640/post-snippets/trunk/src/PostSnippets/Shortcode.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a46c37f4-245d-423f-bdad-296fdf377ecc?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-92098","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T07:16:49.540","lastModified":"2026-10-28T16:17:09.927","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_print_after' parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the targeted site has at least one Contact Form 7 form configured with a [multistep] form-tag, as the canonicalization introduced in version 4.7 blocks the attack path on non-multistep forms."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"webheadllc","product":"Webheadcoder Multi-Step Forms for Contact Form 7","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T14:36:28.512515Z","id":"CVE-2026-92098","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/coreyt808/webheadcoder-multi-step-forms-for-contact-form-7/commit/16f71561797b71548021dc9c4e30b0456e718cd3","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7.1/cf7msm.php","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7/cf7msm.php#L1444","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7/cf7msm.php#L180","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7/cf7msm.php#L225","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-module/tags/4.7/cf7msm.php#L395","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa810af-e620-49e5-9be0-f9fc4d09ed6d?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-101935","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T08:16:29.567","lastModified":"2026-10-29T02:16:45.040","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_kb_config' parameter (specifically the article-mobile-break-point-v2 key, among other config keys interpolated into the <style> element) in versions up to, and including, 17.214.0 This is due to insufficient input sanitization and output escaping in EPKB_Frontend_Editor::fe_preview_config() and EPKB_Articles_Setup: on every knowledge base article page view, when the request supplies epkb_fe_reload_mode=on, an attacker-controlled JSON blob is merged over the stored KB configuration and several values are concatenated directly into a stylesheet emitted inside a literal <style> element without escaping (minify_css() does not strip <, > or /). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user (with Editor-level access or above, holding the manage_categories capability, or an Administrator) into performing an action such as clicking on a specially crafted link."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"echoplugins","product":"Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"17.214.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:28:44.586449Z","id":"CVE-2026-101935","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/echo-knowledge-base/tags/17.214.0/includes/admin/editor/class-epkb-frontend-editor.php#L1072","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/echo-knowledge-base/tags/17.214.0/includes/admin/editor/class-epkb-frontend-editor.php#L848","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/echo-knowledge-base/tags/17.214.0/includes/class-epkb-utilities.php#L836","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/echo-knowledge-base/tags/17.214.0/includes/features/articles/class-epkb-articles-setup.php#L131","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/echo-knowledge-base/tags/17.214.0/includes/features/articles/class-epkb-articles-setup.php#L319","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/echo-knowledge-base/tags/17.214.0/includes/features/layouts/class-epkb-layouts-setup.php#L45","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3727663/echo-knowledge-base/trunk/includes/admin/editor/class-epkb-frontend-editor.php","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3727647%40echo-knowledge-base%2Ftags%2F17.311.0&old=3672811%40echo-knowledge-base%2Ftags%2F17.214.0","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bfab9cf-4ccb-45fc-83ce-b5250f0f6482?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-85655","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T08:16:30.083","lastModified":"2026-11-04T23:10:00.223","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress's standard admin UI and REST API would otherwise forbid that user from editing."},{"lang":"es","value":"El plugin Enable Media Replace para WordPress es vulnerable a una omisión de autorización en todas las versiones hasta la 4.2.2 incluida. Esto se debe a que el plugin no verifica correctamente que un usuario está autorizado para realizar una acción. Esto permite a atacantes autenticados, con acceso de nivel de autor y superior, modificar el post_content de cualquier entrada publicada que haga referencia al medio reemplazado - incluyendo entradas propiedad de Administradores - haciendo que los cambios sean inmediatamente visibles para visitantes no autenticados. El método doReplaceQuery() realiza una búsqueda y reemplazo en toda la base de datos en todas las entradas que contienen la URL del medio antiguo sin ninguna verificación de capacidad por entrada, lo que significa que una única solicitud iniciada por un Autor puede sobrescribir silenciosamente un gran número de entradas que la interfaz de usuario de administración estándar de WordPress y la API REST de otro modo prohibirían a ese usuario editar."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"shortpixel","product":"Enable Media Replace","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.2.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:28:20.530450Z","id":"CVE-2026-85655","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/short-pixel-optimizer/enable-media-replace/releases/tag/v4.2.3","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/build/shortpixel/replacer/src/Replacer.php#L250","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/Controller/ReplaceController.php#L253","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/ViewController/UploadViewController.php#L59","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/ViewController/UploadViewController.php#L66","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/build/shortpixel/replacer/src/Replacer.php#L250","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/Controller/ReplaceController.php#L253","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/ViewController/UploadViewController.php#L59","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/ViewController/UploadViewController.php#L66","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aff42473-63c6-41ca-8312-058f213e2302?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-92797","sourceIdentifier":"security@wordfence.com","published":"2026-10-28T08:16:30.250","lastModified":"2026-11-04T23:10:00.223","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. This makes it possible for unauthenticated attackers to change authenticated users' email addresses via a forged request granted they can trick an authenticated user into performing an action such as clicking on a link, leading to account takeover through password reset functionality."},{"lang":"es","value":"El plugin MemberPress para WordPress es vulnerable a falsificación de petición en sitios cruzados (CSRF) en versiones hasta la 1.14.1 incluida. Esto se debe a una verificación de nonce eludible en la función save_profile_fields() que utiliza una condición isset() en la línea 1119, lo que permite que la verificación de seguridad sea completamente eludida simplemente omitiendo el parámetro nonce de la petición. Esto hace posible que atacantes no autenticados cambien las direcciones de correo electrónico de usuarios autenticados mediante una petición falsificada, siempre que puedan engañar a un usuario autenticado para que realice una acción como hacer clic en un enlace, lo que lleva a la toma de control de la cuenta a través de la funcionalidad de restablecimiento de contraseña."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"MemberPress","product":"Memberpress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.14.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:28:36.326474Z","id":"CVE-2026-92797","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://memberpress.com/change-log/#1.14.2","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fb6cdd0-cd48-49a5-b998-f1c3fbdc25f7?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-103313","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T11:17:13.717","lastModified":"2026-10-28T18:17:01.370","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"BitPay Gateway for WooCommerce","defaultStatus":"unknown","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThanOrEqual":"4.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:37:14.136219Z","id":"CVE-2026-103313","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://wpscan.com/vulnerability/feaebdbf-cfa2-49cf-a8be-d2f22b0ad9c9/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-103330","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T11:17:13.857","lastModified":"2026-10-28T18:17:01.597","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Sadad QA Payment","defaultStatus":"unknown","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"1.28","lessThanOrEqual":"1.28","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:37:05.689292Z","id":"CVE-2026-103330","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0681f5a8-a1cd-44b0-b7c8-c3eacbd9e96a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-106648","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T11:17:14.527","lastModified":"2026-10-28T18:17:04.907","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Royal Elementor Addons","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"1.7.1070","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:36:58.282887Z","id":"CVE-2026-106648","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"references":[{"url":"https://wpscan.com/vulnerability/a93f2619-572d-4432-bf7d-f3f691c30086/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-110508","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T11:17:14.680","lastModified":"2026-10-28T18:17:06.263","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Essential Addons for Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"6.7.3","lessThan":"6.8.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:36:51.371547Z","id":"CVE-2026-110508","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/77c4b22a-b1c2-4b65-b98c-e07489f94864/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-115223","sourceIdentifier":"contact@wpscan.com","published":"2026-10-28T11:17:15.800","lastModified":"2026-10-28T18:17:11.520","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Smart Popup by Supsystic","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"2.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:36:42.808153Z","id":"CVE-2026-115223","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://wpscan.com/vulnerability/cf475664-aa8f-49ec-b1d6-62139dbad8d4/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-116390","sourceIdentifier":"audit@patchstack.com","published":"2026-10-28T14:16:58.507","lastModified":"2026-10-29T14:17:49.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything&nbsp;— WordPress &amp; WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything&nbsp;— WordPress &amp; WooCommerce Filters: from n/a through 1.9.7."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"stepasyuk","product":"Filter Everything&nbsp;— WordPress &amp; WooCommerce Filters","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"filter-everything","versions":[{"version":"0","lessThanOrEqual":"1.9.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:41:34.658429Z","id":"CVE-2026-116390","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/filter-everything/vulnerability/wordpress-filter-everything-wordpress-woocommerce-filters-plugin-1-9-7-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-67187","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-28T16:17:08.767","lastModified":"2026-11-04T23:10:00.223","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file."},{"lang":"es","value":"El plugin Ninja Forms para WordPress anterior a la versión 3.15.4 contiene una vulnerabilidad de validación incompleta del lado del servidor que permite a atacantes no autenticados enviar valores arbitrarios a los campos de Lista de Casillas de Verificación, Lista de Selección Múltiple, Lista de Imágenes, País y Estado porque NF_Abstracts_List pasa a un método validate() que solo verifica la presencia de campos obligatorios. Los atacantes pueden enviar cargas útiles de fórmulas manipuladas a través del endpoint no autenticado nf_ajax_submit que omiten el escape de CSV aplicado solo a los campos de Cuadro de Texto y Área de Texto, lo que resulta en inyección CSV cuando un administrador descarga y abre el archivo de envíos exportado."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Saturday Drive","product":"Ninja Forms","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.15.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-03T13:01:02.972888Z","id":"CVE-2026-67187","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1236"}]}],"references":[{"url":"https://wordpress.org/plugins/ninja-forms/#developers","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ninja-forms-wordpress-plugin-server-side-validation-bypass-via-list-fields","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-118804","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-28T22:17:14.963","lastModified":"2026-10-29T18:17:29.367","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Bricks","product":"Bricks Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T15:43:40.386422Z","id":"CVE-2026-118804","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://bricksbuilder.io/release/bricks-2-4-4/","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/bricks-broken-access-control-via-query-result-endpoint","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-113387","sourceIdentifier":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","published":"2026-10-29T02:16:49.937","lastModified":"2026-10-29T15:12:05.973","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts."}],"affected":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","affectedData":[{"vendor":"canva","product":"ortto","defaultStatus":"unaffected","platforms":["WordPress"],"versions":[{"version":"0","lessThan":"1.0.25","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:49:46.256831Z","id":"CVE-2026-113387","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8","source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6"}]}},{"cve":{"id":"CVE-2026-113409","sourceIdentifier":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","published":"2026-10-29T02:16:50.070","lastModified":"2026-10-29T15:12:05.973","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page."}],"affected":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","affectedData":[{"vendor":"canva","product":"ortto","defaultStatus":"unaffected","platforms":["WordPress"],"versions":[{"version":"0","lessThan":"1.0.25","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:49:28.666693Z","id":"CVE-2026-113409","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8","source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6"}]}},{"cve":{"id":"CVE-2026-114173","sourceIdentifier":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","published":"2026-10-29T02:16:50.187","lastModified":"2026-10-29T15:12:05.973","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store."}],"affected":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","affectedData":[{"vendor":"canva","product":"ortto","defaultStatus":"unaffected","platforms":["WordPress"],"versions":[{"version":"0","lessThan":"1.0.25","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:49:36.815264Z","id":"CVE-2026-114173","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8","source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6"}]}},{"cve":{"id":"CVE-2026-109516","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:22.763","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a `message.chat.id` set to any WordPress login name; `bftow_get_user_system_id()` resolves this attacker-supplied value to the targeted account via `get_user_by('login', $tgId)` with no ownership proof, and writes a login token computed as `md5($_SERVER['HTTP_USER_AGENT'] . time())` — both inputs are fully attacker-controlled or bounded within seconds using the response's own `Date` header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less `?action=bftow_create_order&bftow_token=` endpoint, which calls `wp_set_auth_cookie()` unconditionally via `login_user_by_id`, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"guruteam","product":"Bot for Telegram on WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:32:41.144741Z","id":"CVE-2026-109516","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_Telegram.php#L91","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_Telegram.php#L98","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_User.php#L149","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_User.php#L44","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_User.php#L62","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_WooCommerce.php#L42","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f6b73e0-c154-4bc4-90bc-0929053b77b0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93757","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:43.763","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in all versions up to, and including, 1.0.18. When no WildApricot contact-ID mapping is found for an incoming SSO login, the plugin falls back to a network-global `get_user_by('email', ...)` lookup in `Module.php` to resolve a WordPress user, then `UserSynchronizer::syncWaContact()` binds and `Controller::login()` issues a session cookie via `wp_set_auth_cookie()` for that resolved user — both guarded only by `is_super_admin()` — without ever requiring proof of ownership of the matched WordPress account such as a password, local account-linking confirmation, inbox verification, or administrator approval. This makes it possible for attackers with custom-level WildApricot membership access to authenticate as an existing WordPress subsite administrator on a path-based Multisite network, obtaining a valid network-global authentication cookie for the victim without their credentials. Exploitation requires that the attacker control a WildApricot contact whose email address matches the target WordPress administrator's email — achievable via a public zero-fee membership application on the connected WildApricot organization — and that they complete the SSO flow on any subsite where Wild Apricot Login is active; because WordPress user identities and authentication cookies are network-global, the cookie issued on that subsite is equally valid on any other subsite where the victim user holds an administrator role."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wild-apricot","product":"Wild Apricot Login","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.0.18","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:34:17.390489Z","id":"CVE-2026-93757","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wild-apricot-login/tags/1.0.18/Modules/Authorization/WaLogin/Controller.php#L347","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wild-apricot-login/tags/1.0.18/Modules/Core/Module.php#L112","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wild-apricot-login/tags/1.0.18/Modules/Core/Module.php#L159","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wild-apricot-login/tags/1.0.18/Modules/Core/WaApi/Client.php#L22","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wild-apricot-login/tags/1.0.18/Modules/Synchronization/UserSynchronizer.php#L36","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9adbe55e-f1a1-4fa8-b28d-539d90d81c68?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93855","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:43.923","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce gating the handler uses the hardcoded action value 'sendpress-is-awesome', which is rendered on the same public page served by the [sp-form formid=\"manage\"] shortcode, making it trivially obtainable by unauthenticated visitors and effectively bypassing the nonce as an access control."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"brewlabs","product":"SendPress Newsletters","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.1.20","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:32:52.850610Z","id":"CVE-2026-93855","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/sendpress/tags/1.26.1.20/classes/class-sendpress-data.php#L1300","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/sendpress/tags/1.26.1.20/classes/sc/class-sendpress-sc-forms.php#L580","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b562f31-6a57-4719-a0e1-6a92affef844?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93904","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:44.543","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL Injection via the 'exclude_posts' parameter in all versions up to, and including, 4.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The HMAC authentication gate protecting the endpoint is bypassable on any freshly activated installation where an administrator has not yet visited the settings page, because the secret_key option remains empty until lazily generated at that point, allowing an attacker to compute a valid token using hash_hmac('sha256', '', $timestamp) with any chosen timestamp."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"dejanmarkovic","product":"Social Web Suite – Social Media Auto Post, Social Media Auto Publish","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.1.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:33:02.271054Z","id":"CVE-2026-93904","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/admin/class-socialwebsuite-admin.php#L432","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/admin/class-socialwebsuite-admin.php#L479","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/admin/class-socialwebsuite-admin.php#L58","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/class-socialwebsuite.php#L831","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d338b15-ec26-4239-b90a-1ea8d5ba5ce0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96228","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:45.110","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"sslplugins","product":"SSL Wireless SMS Notification","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.8.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:34:31.132896Z","id":"CVE-2026-96228","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.svn.wordpress.org/ssl-wireless-sms-notification/tags/3.8.1/sslWireless.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4947d5-91f3-4b36-b309-7c52c483be3d?source=cve","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ssl-wireless-sms-notification/ssl-wireless-sms-notification-360-unauthenticated-privilege-escalation","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96666","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:45.273","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled the plugin's 'Remove Microdata' option and approves the malicious comment."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"vberkel","product":"Schema App Structured Data","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.3.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:33:19.918616Z","id":"CVE-2026-96666","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/schema-app-structured-data-for-schemaorg/tags/2.3.2/lib/SchemaFront.php#L40","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/schema-app-structured-data-for-schemaorg/tags/2.3.2/lib/SchemaFront.php#L541","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/schema-app-structured-data-for-schemaorg/tags/2.3.2/lib/SchemaFront.php#L547","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0a6ba5-6b2a-49b2-8780-df5eb6a5eecd?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96669","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:45.430","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'service_type' Cookie in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack is seeded unauthenticated by supplying a payload via the ?type= query parameter on the public checkout page, which the plugin writes directly into the browser's service_type cookie; this cookie value is later persisted to order meta and rendered unescaped in the admin panel."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpscripts","product":"Food Store – Online Food Delivery & Pickup","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.5.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:32:18.436979Z","id":"CVE-2026-96669","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L150","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L397","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L398","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L521","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/wfs-core-functions.php#L795","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60725f12-6219-4c5e-8b5c-e925f0837ddb?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96741","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:45.600","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled both the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option, and requires the crafted comment to be approved by an administrator."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"mlfactory","product":"DSGVO All in one for WP","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:32:30.976506Z","id":"CVE-2026-96741","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/tags/5.0/dsgvo_all_in_one_wp.php#L1611","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/tags/5.0/dsgvo_all_in_one_wp.php#L2901","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/tags/5.0/dsgvo_all_in_one_wp.php#L2909","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/219b29a6-6148-4cc9-960c-b28f2d90236e?source=cve","source":"security@wordfence.com"}]}}]}