CVE-2026-118435
Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.
PozostałeOpis źródłowy · EN
- CVSS
- 5,4
- EPSS
- 0,21 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
KATALOG PODATNOŚCI
Publikacje w kolejności czasu
Chronologiczny przegląd publikacji. Ostatnie modyfikacje są w osobnym widoku.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
CVE-2026-76780
The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoach_write_redirectManager' (and sibling rankingcoach_write_* module capabilities) to…
PozostałeOpis źródłowy · EN
- CVSS
- 6,3
- EPSS
- 0,21 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-77188
The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'type' Shortcode Attribute in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This…
PozostałeOpis źródłowy · EN
- CVSS
- 6,4
- EPSS
- 0,19 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-77871
The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping.…
PozostałeOpis źródłowy · EN
- CVSS
- 6,4
- EPSS
- 0,24 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-92098
The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_print_after' parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output…
PozostałeOpis źródłowy · EN
- CVSS
- 6,1
- EPSS
- 0,22 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-118164
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repeater[*][version_uid] (and many sibling fields: freeze-mode, cookie-input, ip-input, compare, utm-value,…
PozostałeOpis źródłowy · EN
- CVSS
- 6,4
- EPSS
- 0,21 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-118169
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[cta_label]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and…
PozostałeOpis źródłowy · EN
- CVSS
- 4,9
- EPSS
- 0,19 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-2839
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,27 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-63286
Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete…
MonitorujOpis źródłowy · EN
- CVSS
- 7,1
- EPSS
- 0,08 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-76005
The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient…
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,28 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-76058
The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible…
PozostałeOpis źródłowy · EN
- CVSS
- 5,3
- EPSS
- 0,26 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-111372
The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it…
PozostałeOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,27 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116609
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsm_showTrafficStatsList] shortcode in versions up to, and including, 8.8 This is…
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,34 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116610
The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. This…
PozostałeOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,2 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116749
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it…
PozostałeOpis źródłowy · EN
- CVSS
- 6,4
- EPSS
- 0,19 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116750
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient…
PozostałeOpis źródłowy · EN
- CVSS
- 6,5
- EPSS
- 0,26 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-116761
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field inside group — field id controlled by integrator config)' parameter in all versions up to, and including, 2.13.4 due to insufficient input…
PozostałeOpis źródłowy · EN
- CVSS
- 5,4
- EPSS
- 0,22 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-110071
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
PozostałeOpis źródłowy · EN
- CVSS
- 6,4
- EPSS
- 0,2 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-110185
The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image (any body field referenced by the…
PozostałeOpis źródłowy · EN
- CVSS
- 5,9
- EPSS
- 0,55 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-110662
The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output…
MonitorujOpis źródłowy · EN
- CVSS
- 7,2
- EPSS
- 0,31 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-111068
The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
PozostałeOpis źródłowy · EN
- CVSS
- 4,4
- EPSS
- 0,21 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-111111
The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.7.2 due to insufficient input…
MonitorujOpis źródłowy · EN
- CVSS
- 7,2
- EPSS
- 0,24 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-111120
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it…
MonitorujOpis źródłowy · EN
- CVSS
- 8,8
- EPSS
- 0,32 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-111213
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an…
PozostałeOpis źródłowy · EN
- CVSS
- 4,3
- EPSS
- 0,22 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
CVE-2026-109972
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, <=…
PozostałeOpis źródłowy · EN
- CVSS
- 6,4
- EPSS
- 0,27 %
- Publikacja
- Poprawka
- Status poprawki nieustalony
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-118435 Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation. |
Pozostałe |
CVSS 5,4EPSS 0,21 % | ||
| CVE-2026-76780 The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the… |
Pozostałe |
CVSS 6,3EPSS 0,21 % | ||
| CVE-2026-77188 The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'type' Shortcode Attribute in all versions up to, and including,… |
Pozostałe |
CVSS 6,4EPSS 0,19 % | ||
| CVE-2026-77871 The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and… |
Pozostałe |
CVSS 6,4EPSS 0,24 % | ||
| CVE-2026-92098 The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_print_after' parameter in all versions up to, and… |
Pozostałe |
CVSS 6,1EPSS 0,22 % | ||
| CVE-2026-118164 The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repeater[*][version_uid] (and many… |
Pozostałe |
CVSS 6,4EPSS 0,21 % | ||
| CVE-2026-118169 The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[cta_label]' parameter in all versions up… |
Pozostałe |
CVSS 4,9EPSS 0,19 % | ||
| CVE-2026-2839 The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7.… |
Pozostałe |
CVSS 5,3EPSS 0,27 % | ||
| CVE-2026-63286 Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one… |
Monitoruj |
CVSS 7,1EPSS 0,08 % | ||
| CVE-2026-76005 The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient… |
Pozostałe |
CVSS 6,5EPSS 0,28 % | ||
| CVE-2026-76058 The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying… |
Pozostałe |
CVSS 5,3EPSS 0,26 % | ||
| CVE-2026-111372 The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly… |
Pozostałe |
CVSS 4,3EPSS 0,27 % | ||
| CVE-2026-116609 The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the… |
Pozostałe |
CVSS 6,5EPSS 0,34 % | ||
| CVE-2026-116610 The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the… |
Pozostałe |
CVSS 4,3EPSS 0,2 % | ||
| CVE-2026-116749 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter in all versions up to, and including, 1.4.10 due… |
Pozostałe |
CVSS 6,4EPSS 0,19 % | ||
| CVE-2026-116750 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to… |
Pozostałe |
CVSS 6,5EPSS 0,26 % | ||
| CVE-2026-116761 The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field inside group — field id controlled by integrator config)' parameter… |
Pozostałe |
CVSS 5,4EPSS 0,22 % | ||
| CVE-2026-110071 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input… |
Pozostałe |
CVSS 6,4EPSS 0,2 % | ||
| CVE-2026-110185 The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and… |
Pozostałe |
CVSS 5,9EPSS 0,55 % | ||
| CVE-2026-110662 The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to,… |
Monitoruj |
CVSS 7,2EPSS 0,31 % | ||
| CVE-2026-111068 The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input… |
Pozostałe |
CVSS 4,4EPSS 0,21 % | ||
| CVE-2026-111111 The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all… |
Monitoruj |
CVSS 7,2EPSS 0,24 % | ||
| CVE-2026-111120 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or… |
Monitoruj |
CVSS 8,8EPSS 0,32 % | ||
| CVE-2026-111213 The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the… |
Pozostałe |
CVSS 4,3EPSS 0,22 % | ||
| CVE-2026-109972 The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… |
Pozostałe |
CVSS 6,4EPSS 0,27 % |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 11.11.2026, 11:32 UTC – 11.11.2026, 13:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.
NVD · publikacjeOstatnie przetworzenie zakończone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.