{"resultsPerPage":35,"startIndex":0,"totalResults":35,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T12:54:07.408","vulnerabilities":[{"cve":{"id":"CVE-2026-64531","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-07-27T08:16:22.243","lastModified":"2026-08-01T08:16:29.920","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: reject oversized nested action attrs\n\nOpen vSwitch stores generated flow actions as nlattrs, whose nla_len\nfield is u16. Commit a1e64addf3ff (\"net: openvswitch: remove\nmisbehaving actions length check\") allowed the total sw_flow_actions\nstream to grow beyond 64 KiB, which is valid, but also removed the last\nguard preventing a generated nested action attribute from exceeding\nU16_MAX.\n\nAn oversized generated container can thus be closed with a truncated\nnla_len. A later dump or teardown then walks a structurally different\nstream than the one that was validated. In particular, an oversized\nnested CLONE/CT action may cause subsequent bytes in the generated\nstream to be interpreted as independent actions.\n\nKeep the larger total-action-stream behavior, but make nested action\nclose reject generated containers that do not fit in nla_len, and return\nthe error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and\nCHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse\nconstruction order before discarding failed wrappers, so resources copied\ninto the rejected tails are released before the wrappers are removed.\n\nMost failed outer wrappers are discarded by truncating actions_len after\nchild resources have been released. CHECK_PKT_LEN also trims its parent\nafter branch resources are gone. SET/TUNNEL close failures unwind their\nknown tun_dst ownership directly, and SET_TO_MASKED has no external\nownership and truncates on close failure."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/openvswitch/flow_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"057dbc5b72e9fcac439cd561c3a539b8a0edeb92","lessThan":"ab855641241387db062a5e41d9ad6b8561542572","versionType":"git","status":"affected"},{"version":"2532adbfe917c0e71dba2650ffc6efe396314c87","lessThan":"c66bd2626c2764f23764ff0f8277f44a9cfe8349","versionType":"git","status":"affected"},{"version":"4b1a0ee6164c7204c68ab5a9c48c07bfe8852485","lessThan":"d573250d228401f707f4dbc09d11227a6215ee5f","versionType":"git","status":"affected"},{"version":"e6610f9c08b4c04cf7949c10fc246c071d00e935","lessThan":"f1efff8858403191361a01269c6fe8dd7f55a385","versionType":"git","status":"affected"},{"version":"a1e64addf3ff9257b45b78bc7d743781c3f41340","lessThan":"dbd14f736be02cfe73049bd801af89becd1a0749","versionType":"git","status":"affected"},{"version":"a1e64addf3ff9257b45b78bc7d743781c3f41340","lessThan":"1b41cbe05b184f8861712f0806cc0c4f5d8c6dfe","versionType":"git","status":"affected"},{"version":"a1e64addf3ff9257b45b78bc7d743781c3f41340","lessThan":"3f1f755366687d051174739fb99f7d560202f60b","versionType":"git","status":"affected"},{"version":"6b099d285d7ed324494b6d684f377aa103856118","versionType":"git","status":"affected"},{"version":"5.15.180","lessThan":"5.15.212","versionType":"semver","status":"affected"},{"version":"6.1.132","lessThan":"6.1.178","versionType":"semver","status":"affected"},{"version":"6.6.84","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.20","lessThan":"6.12.97","versionType":"semver","status":"affected"},{"version":"6.13.8","lessThan":"6.14","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/openvswitch/flow_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc4","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1b41cbe05b184f8861712f0806cc0c4f5d8c6dfe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3f1f755366687d051174739fb99f7d560202f60b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab855641241387db062a5e41d9ad6b8561542572","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c66bd2626c2764f23764ff0f8277f44a9cfe8349","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d573250d228401f707f4dbc09d11227a6215ee5f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dbd14f736be02cfe73049bd801af89becd1a0749","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1efff8858403191361a01269c6fe8dd7f55a385","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"http://www.openwall.com/lists/oss-security/2026/07/28/8","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/07/31/17","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/08/01/1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/08/01/3","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-66066","sourceIdentifier":"security-advisories@github.com","published":"2026-07-30T19:18:35.843","lastModified":"2026-08-01T08:16:30.147","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rails","product":"rails","versions":[{"version":"< 7.2.3.2","status":"affected"},{"version":">= 8.0.0.beta1, < 8.0.5.1","status":"affected"},{"version":">= 8.1.0.beta1, < 8.1.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.5,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-30T19:16:09.405495Z","id":"CVE-2026-66066","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1188"}]}],"references":[{"url":"https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e","source":"security-advisories@github.com"},{"url":"https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5","source":"security-advisories@github.com"},{"url":"https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a","source":"security-advisories@github.com"},{"url":"https://github.com/rails/rails/releases/tag/v7.2.3.2","source":"security-advisories@github.com"},{"url":"https://github.com/rails/rails/releases/tag/v8.0.5.1","source":"security-advisories@github.com"},{"url":"https://github.com/rails/rails/releases/tag/v8.1.3.1","source":"security-advisories@github.com"},{"url":"https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm","source":"security-advisories@github.com"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml","source":"security-advisories@github.com"},{"url":"https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html","source":"security-advisories@github.com"},{"url":"http://www.openwall.com/lists/oss-security/2026/07/29/9","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/08/01/6","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2025-15669","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:27.603","lastModified":"2026-08-01T07:16:27.603","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Bit Form  WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Bit Form","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.1.4","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/69800fa9-4fbd-489c-8759-96df745d77d6/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-10827","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:28.573","lastModified":"2026-08-01T07:16:28.573","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Spectra Legacy  WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. The injected styles are served to anonymous visitors of those pages and can force external resource loads, deface/redress the page, or exfiltrate data via CSS attribute selectors. JavaScript execution is not possible at this role (the script-tag breakout is removed by KSES), so the impact is limited to CSS injection."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Spectra Legacy","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.20.0","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/068ac525-423b-42f8-9ef4-f102f948dc78/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-11882","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:28.687","lastModified":"2026-08-01T07:16:28.687","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable overwrite requires the site to already be connected to a paid account."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Builderall for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/23e0eb03-ec19-4cec-8127-cb6c2c2f4d7b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-12696","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:28.797","lastModified":"2026-08-01T07:16:28.797","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"wpForo Forum","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.1.2","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/0dde2d89-267f-4aca-b2f0-d086b15adff0/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-12966","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:28.913","lastModified":"2026-08-01T07:16:28.913","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Direct Payments for WooCommerce  WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with other customers' orders, including forging a \"payment sent\" state, overwriting the payment-method label, and attaching forged payment-proof files."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Direct Payments for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/b2b7f90e-359f-4fb4-9b48-c87ecb229f76/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-13157","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:29.030","lastModified":"2026-08-01T07:16:29.030","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The  Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Theme Demo Import","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"1.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/5d6a6a8e-c224-4034-8ed5-2d63f37f9479/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-13158","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:29.133","lastModified":"2026-08-01T07:16:29.133","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Everest Toolkit","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"1.2.3","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/f101071f-402a-40a2-bbdb-666512cd4049/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-13329","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:29.243","lastModified":"2026-08-01T07:16:29.243","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Buckaroo Woocommerce Payments Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.9.0","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/6e60d271-574d-4259-ab51-32a014e480d4/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-13596","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:29.347","lastModified":"2026-08-01T07:16:29.347","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Participants Database","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.7.8.4","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/e22227c8-506e-4188-a7a1-1952b41c47f5/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-13604","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:29.457","lastModified":"2026-08-01T07:16:29.457","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Pixelavo  WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows an unauthenticated visitor to inject arbitrary conversion events into the administrator's Facebook ads account and exhaust the configured API quota."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Pixelavo","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/766c961e-e5aa-4ebe-8107-032f46316f91/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-13725","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:29.560","lastModified":"2026-08-01T07:16:29.560","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Dynamic Pricing With Discount Rules for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/5e3786de-4b4d-4da2-b129-7b0fef90a386/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-13729","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:29.667","lastModified":"2026-08-01T07:16:29.667","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Podlove Podcast Publisher","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/24022bde-e87a-4bee-87da-68897cbb8b93/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14195","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:29.763","lastModified":"2026-08-01T07:16:29.763","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Brizy  WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Brizy","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.18","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/2ed270b0-c01e-4615-b365-3455c161a2d9/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14197","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:29.883","lastModified":"2026-08-01T07:16:29.883","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Fluent Support  WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Fluent Support","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.1","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/cd488221-6efd-42a0-badc-315c60ec0b99/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14214","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:29.990","lastModified":"2026-08-01T07:16:29.990","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Booking for Appointments and Events Calendar  WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Booking for Appointments and Events Calendar","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.4","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/4dd7bb63-e058-49d8-96ba-1fe38985e78e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14292","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:30.097","lastModified":"2026-08-01T07:16:30.097","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Download Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.3.66","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/719b6675-7891-4742-9751-bba2e72414a8/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14309","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:30.207","lastModified":"2026-08-01T07:16:30.207","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Chat On Desk Order Notifications  WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Chat On Desk Order Notifications","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.9","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/82f14006-c05f-421d-9ba5-bc745e0b2ab8/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14315","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:30.307","lastModified":"2026-08-01T07:16:30.307","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Pixel Tag Manager for WooCommerce  WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Pixel Tag Manager for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/0d7c113a-b677-4687-a077-ec0ec7deff83/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14561","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:30.410","lastModified":"2026-08-01T07:16:30.410","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Authora : Easy login with mobile number","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.7.7","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/4025601f-ed33-4772-b716-a9979830e10d/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14596","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:30.517","lastModified":"2026-08-01T07:16:30.517","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an attacker-controlled host and carries a valid reset key, leading to account takeover when the victim clicks it."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"DynamicKit for Elementor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/a23eb55c-f5b1-4dcb-8d53-6e71d80e050a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14822","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:30.623","lastModified":"2026-08-01T07:16:30.623","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Event Tickets and Registration","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.29.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/ec32cf58-9fc0-4817-8492-92d80be74ef4/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14823","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:30.730","lastModified":"2026-08-01T07:16:30.730","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Event Tickets and Registration","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.29.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/50fcd505-11bc-4208-aa27-54651f82e80e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14836","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:30.827","lastModified":"2026-08-01T07:16:30.827","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Login & Register Forms  WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Login & Register Forms","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.2.5","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/9bdb7959-dbe7-4f48-892b-b9ee4c8eb060/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14839","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:30.947","lastModified":"2026-08-01T07:16:30.947","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Mapster WP Maps","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.24.0","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/1994e67d-5fdc-445f-a09d-2b25d2b2f445/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14840","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:31.060","lastModified":"2026-08-01T07:16:31.060","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"YOP Poll","defaultStatus":"unaffected","versions":[{"version":"7.0.0","lessThan":"7.0.6","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/fc810ca2-3f27-414d-b94a-68842925b7c6/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-15234","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:31.163","lastModified":"2026-08-01T07:16:31.163","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of any higher-privileged user (such as an administrator) who views the content."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Codeless Page Builder","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"1.1.4","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/519a69d5-ab6f-449a-ab78-78b68598d37f/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-15244","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:31.267","lastModified":"2026-08-01T07:16:31.267","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The HUSKY  WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"HUSKY","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/7384ebb7-a581-45c7-ab48-0fdf30a1569d/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-15262","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:31.373","lastModified":"2026-08-01T07:16:31.373","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Admin Columns for ACF Fields","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"0.3.2","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/dea1f3a9-2681-47a6-9e36-9d6ea799decb/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-15368","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:31.477","lastModified":"2026-08-01T07:16:31.477","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The User Profile Builder  WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"User Profile Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.16.4","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/df1eb738-15bf-4f8b-aa06-e0a42f1e9c2e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-15932","sourceIdentifier":"contact@wpscan.com","published":"2026-08-01T07:16:31.583","lastModified":"2026-08-01T07:16:31.583","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Support Genix  WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Support Genix","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.4.48","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://wpscan.com/vulnerability/d03887a5-1a0e-4097-8dfa-7899aae8a6d5/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2025-14469","sourceIdentifier":"security@wordfence.com","published":"2026-08-01T08:16:29.167","lastModified":"2026-08-01T08:16:29.167","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the ms_update AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"mndpsingh287","product":"Theme Editor","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/theme-editor/trunk/includes/classes/ms_theme_editor_controller.php#L13","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/theme-editor/trunk/includes/classes/ms_theme_editor_controller.php#L60","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/theme-editor/#developers","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dd4e39a-9b2f-4728-b026-2dee60257c46?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15988","sourceIdentifier":"security@wordfence.com","published":"2026-08-01T08:16:29.610","lastModified":"2026-08-01T08:16:29.610","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauth_for_authorize function. This makes it possible for unauthenticated attackers to create new administrator accounts with attacker-supplied credentials via a CSRF-based REST authentication bypass, granted they can trick a site administrator into performing an action such as clicking on a link. This bypass can be combined with WordPress's ?_method=POST method-override support to convert a top-navigation GET request into an authenticated POST to the REST users endpoint, requiring no existing account on the attacker's part."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"tigroumeow","product":"AI Engine – The Chatbot, AI Framework & MCP for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.6.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.6.2/labs/mcp-oauth.php#L120","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.6.2/labs/mcp-oauth.php#L121","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.6.2/labs/mcp-oauth.php#L127","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.6.2/labs/mcp-oauth.php#L49","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3628188/ai-engine/trunk/labs/mcp-oauth.php","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Fai-engine/tags/3.6.5&new_path=%2Fai-engine/tags/3.6.6","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45816c45-42bc-4163-b700-a1e913f32c97?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-2916","sourceIdentifier":"security@wordfence.com","published":"2026-08-01T08:16:29.763","lastModified":"2026-08-01T08:16:29.763","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` method in `class/dashboard/class-dashboard.php`. The plugin injects a `JkitDashboardOption` JavaScript object containing full plugin inventory (names, versions, paths, active status), system environment details (WordPress version, PHP version, site URLs, server capabilities), and potentially third-party API credentials (Mailchimp API key via `jkit_user_data`) as an inline script on the `post.php` admin page. Because this data is output without any capability check beyond post editing access, any authenticated user with Contributor-level access or above can view this sensitive configuration data by inspecting the page source. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive site configuration data, installed plugin details, and potentially third-party API keys."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"jegtheme","product":"Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php#L497","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php#L523","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php#L675","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Fjeg-elementor-kit/tags/3.1.1&new_path=%2Fjeg-elementor-kit/tags/3.1.2","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a420a8b5-e43e-4c0d-86f3-b35f11efdf46?source=cve","source":"security@wordfence.com"}]}}]}