Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    402885 vulnerabilities

    No criteria set — showing every indexed entry of the selected sources, newest first by published date.

    CVE-2026-92798 (GCVE-0-2026-92798)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
    Summary
    The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.
    Severity
    8.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Credits
    Passakorn Yookindee
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder",
          "vendor": "wpeverest",
          "versions": [
            {
              "lessThanOrEqual": "5.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Passakorn Yookindee"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The User Registration \u0026 Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the \u0027referrer_url\u0027 branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() \u2014 which does not strip WordPress shortcode delimiters \u2014 before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:31.068Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec317df9-c7ef-49a3-9818-903dfe4bdd03?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L475"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L474"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/class-urcr-frontend.php#L1383"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/functions-urcr-core.php#L693"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/class-ur-smart-tags.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-16T19:59:06.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:42:54.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "User Registration \u0026 Membership \u003c= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via \u0027referrer_url\u0027 Smart Tag"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-92798",
    "datePublished": "2026-10-17T03:43:31.068Z",
    "dateReserved": "2026-09-16T19:44:13.265Z",
    "dateUpdated": "2026-10-17T03:43:31.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-103899 (GCVE-0-2026-103899)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter
    Summary
    The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce → Orders → Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    daigo75 EU VAT Assistant for WooCommerce Affected: 0 , ≤ 2.1.30.260413 (semver)
    		Create a notification for this product.
    Credits
    Afifudin Maarif
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "EU VAT Assistant for WooCommerce",
          "vendor": "daigo75",
          "versions": [
            {
              "lessThanOrEqual": "2.1.30.260413",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Afifudin Maarif"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027vat_number\u0027 parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator\u0027s browser context when reviewing an order via WooCommerce \u2192 Orders \u2192 Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:30.740Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e2cd7c07-e119-4064-a7a9-08c81409f90a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/lib/classes/integration/admin/orders_integration.php#L238"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/views/admin/order-vat-info-box.php#L173"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/lib/classes/order/order.php#L56"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/plugin-main.php#L901"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/plugin-main.php#L1655"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/lib/classes/integration/vat_number_validation/validators/vat_number_validator.php#L132"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-01T18:51:16.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:38:25.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "EU VAT Assistant for WooCommerce \u003c= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via \u0027vat_number\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-103899",
    "datePublished": "2026-10-17T03:43:30.740Z",
    "dateReserved": "2026-10-01T13:55:27.399Z",
    "dateUpdated": "2026-10-17T03:43:30.740Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109989 (GCVE-0-2026-109989)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter
    Summary
    The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    themifyme Themify Popup Affected: 0 , ≤ 1.4.7 (semver)
    		Create a notification for this product.
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Themify Popup",
          "vendor": "themifyme",
          "versions": [
            {
              "lessThanOrEqual": "1.4.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027popup_width_unit\u0027 parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:30.393Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/da003985-7fb2-4f5b-bb70-6ec3578ef3e8?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/themify-popup/tags/1.4.7/views/styles.php#L29"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/themify-popup/tags/1.4.7/includes/themify-metabox/includes/themify-metabox-core.php#L209"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/themify-popup/tags/1.4.7/includes/themify-metabox/includes/themify-metabox-core.php#L151"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3749602%40themify-popup\u0026new=3749602%40themify-popup"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-13T12:49:09.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:36:36.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Themify Popup \u003c= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via \u0027popup_width_unit\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109989",
    "datePublished": "2026-10-17T03:43:30.393Z",
    "dateReserved": "2026-10-13T12:33:27.631Z",
    "dateUpdated": "2026-10-17T03:43:30.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-107744 (GCVE-0-2026-107744)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
    Summary
    The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Credits
    Kuba
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:30.064Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d1894596-b430-41b3-9d28-12c7dea7ff9b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php#L105"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php#L80"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-request-handler.php#L173"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3750011/learnpress/trunk/inc/admin/class-lp-admin-ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T18:40:24.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:31:20.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via \u0027search-authors\u0027 AJAX Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-107744",
    "datePublished": "2026-10-17T03:43:30.064Z",
    "dateReserved": "2026-10-08T18:25:02.823Z",
    "dateUpdated": "2026-10-17T03:43:30.064Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-111726 (GCVE-0-2026-111726)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
    Summary
    The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'slider' custom post type is active, which is satisfied automatically when the plugin is paired with a Themify theme or any other plugin that registers the 'slider' CPT.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    themifyme Themify Builder Affected: 0 , ≤ 7.8.2 (semver)
    		Create a notification for this product.
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Themify Builder",
          "vendor": "themifyme",
          "versions": [
            {
              "lessThanOrEqual": "7.8.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027visible\u0027 Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the \u0027slider\u0027 custom post type is active, which is satisfied automatically when the plugin is paired with a Themify theme or any other plugin that registers the \u0027slider\u0027 CPT."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:29.731Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d5bc13-585d-405d-b6f3-14db26464e55?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.8.2/templates/template-slider.php#L90"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.8.2/modules/module-slider.php#L113"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3749606%40themify-builder\u0026new=3749606%40themify-builder"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-09T18:15:44.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:35:46.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Themify Builder \u003c= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027visible\u0027 Shortcode Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-111726",
    "datePublished": "2026-10-17T03:43:29.731Z",
    "dateReserved": "2026-10-16T14:35:37.817Z",
    "dateUpdated": "2026-10-17T03:43:29.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-108123 (GCVE-0-2026-108123)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
    Summary
    The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    murgroland WP Booking System – Booking Calendar Affected: 0 , ≤ 2.1.0.3 (semver)
    		Create a notification for this product.
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Booking System \u2013 Booking Calendar",
          "vendor": "murgroland",
          "versions": [
            {
              "lessThanOrEqual": "2.1.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Booking System \u2013 Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:29.401Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a86fab4a-71ec-4006-96f0-46202de2f389?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/booking/functions.php#L250"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/functions.php#L30"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/booking/functions.php#L244"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/trunk/includes/base/admin/booking/functions.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3750085/wp-booking-system/trunk/includes/base/admin/booking/functions.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-09T14:39:32.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:38:40.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Booking System \u003c= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via \u0027wpbs_action=email_logs\u0027 Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-108123",
    "datePublished": "2026-10-17T03:43:29.401Z",
    "dateReserved": "2026-10-09T14:24:17.800Z",
    "dateUpdated": "2026-10-17T03:43:29.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92978 (GCVE-0-2026-92978)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()
    Summary
    The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core's own bulk-users nonce validation from executing.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    CWE
    • CWE-352 - Cross-Site Request Forgery (CSRF)
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Credits
    Jonah Burgess (CryptoCat)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder",
          "vendor": "wpeverest",
          "versions": [
            {
              "lessThanOrEqual": "5.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jonah Burgess (CryptoCat)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core\u0027s own bulk-users nonce validation from executing."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:29.067Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/713c4652-9ca0-41f7-9a93-8186d9b359e8?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/admin/class-ur-admin-user-list-manager.php#L687"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/admin/class-ur-admin-user-list-manager.php#L667"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/admin/class-ur-admin-user-list-manager.php#L140"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/admin/class-ur-admin-user-list-manager.php#L36"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/admin/class-ur-admin-user-list-manager.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-17T13:57:17.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:40:54.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "User Registration \u0026 Membership \u003c= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-92978",
    "datePublished": "2026-10-17T03:43:29.067Z",
    "dateReserved": "2026-09-17T13:42:24.513Z",
    "dateUpdated": "2026-10-17T03:43:29.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109369 (GCVE-0-2026-109369)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse
    Summary
    The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves and arbitrary other users edit access to every booking form on the site by overwriting the user_permission meta that governs the plugin's own access-control list. Exploitation requires the attacker to have already been delegated edit rights on at least one booking form, as this delegation both downgrades the submenu capability to 'read' (making the edit page accessible) and allows them to harvest a valid wpbs_edit_form nonce that will pass validation against any other form_id.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    murgroland WP Booking System – Booking Calendar Affected: 0 , ≤ 2.1.0.3 (semver)
    		Create a notification for this product.
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Booking System \u2013 Booking Calendar",
          "vendor": "murgroland",
          "versions": [
            {
              "lessThanOrEqual": "2.1.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Booking System \u2013 Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves and arbitrary other users edit access to every booking form on the site by overwriting the user_permission meta that governs the plugin\u0027s own access-control list. Exploitation requires the attacker to have already been delegated edit rights on at least one booking form, as this delegation both downgrades the submenu capability to \u0027read\u0027 (making the edit page accessible) and allows them to harvest a valid wpbs_edit_form nonce that will pass validation against any other form_id."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:28.717Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d795763-1c26-4ad8-b4b5-d9c051f064fb?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/modules/user-restrictions/functions-restrictions-form.php#L56"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/form/functions-actions-form.php#L97"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/functions.php#L30"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?old=3730163\u0026old_path=%2Fwp-booking-system%2Ftrunk\u0026new=\u0026new_path=%2Fwp-booking-system%2Ftrunk"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3750120/wp-booking-system/trunk/includes/modules/user-restrictions/functions-restrictions-form.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T14:37:52.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:39:08.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Booking System \u003c= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via \u0027user_permission\u0027 Parameter via Cross-Form Nonce Reuse"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109369",
    "datePublished": "2026-10-17T03:43:28.717Z",
    "dateReserved": "2026-10-12T14:22:17.159Z",
    "dateUpdated": "2026-10-17T03:43:28.717Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-96660 (GCVE-0-2026-96660)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
    Summary
    The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Credits
    Kuba
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder",
          "vendor": "wpeverest",
          "versions": [
            {
              "lessThanOrEqual": "5.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:28.389Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/690d23ee-cf70-4ecf-8cd2-21f673788d5f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/functions-ur-template.php#L555"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/frontend/class-ur-frontend-form-handler.php#L519"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-ajax.php#L221"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/functions-ur-core.php#L5606"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/frontend/class-ur-frontend-form-handler.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-23T15:04:33.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:40:38.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "User Registration \u0026 Membership \u003c= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-96660",
    "datePublished": "2026-10-17T03:43:28.389Z",
    "dateReserved": "2026-09-23T14:49:27.932Z",
    "dateUpdated": "2026-10-17T03:43:28.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-104736 (GCVE-0-2026-104736)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
    Summary
    The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-502 - Deserialization of Untrusted Data
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the \u0027checkout-email\u0027 request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() \u2192 unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:28.046Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-session-handler.php#L373"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L377"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L523"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-ajax.php#L21"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3750024%40learnpress\u0026new=3750024%40learnpress"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T12:07:17.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:33:32.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.4.10 - Unauthenticated PHP Object Injection via \u0027checkout-email\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104736",
    "datePublished": "2026-10-17T03:43:28.046Z",
    "dateReserved": "2026-10-02T11:52:06.705Z",
    "dateUpdated": "2026-10-17T03:43:28.046Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109368 (GCVE-0-2026-109368)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action
    Summary
    The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking descriptions and booking IDs from any calendar managed by the site.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    murgroland WP Booking System – Booking Calendar Affected: 0 , ≤ 2.1.0.3 (semver)
    		Create a notification for this product.
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Booking System \u2013 Booking Calendar",
          "vendor": "murgroland",
          "versions": [
            {
              "lessThanOrEqual": "2.1.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Booking System \u2013 Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the \u0027id\u0027 parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking descriptions and booking IDs from any calendar managed by the site."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:27.683Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/164a276a-612f-416f-b9ef-1c2e6dd0e8e4?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/calendar/functions-actions-ajax-calendar.php#L12"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/calendar/functions-actions-ajax-calendar.php#L62"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/calendar/class-calendar-editor-outputter.php#L484"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/calendar/class-calendar-editor-outputter.php#L432"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?old=3730163\u0026old_path=%2Fwp-booking-system%2Ftrunk\u0026new=\u0026new_path=%2Fwp-booking-system%2Ftrunk"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3750120/wp-booking-system/trunk/includes/base/admin/calendar/functions-actions-ajax-calendar.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T14:38:41.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:38:46.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Booking System \u003c= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109368",
    "datePublished": "2026-10-17T03:43:27.683Z",
    "dateReserved": "2026-10-12T14:22:00.629Z",
    "dateUpdated": "2026-10-17T03:43:27.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92715 (GCVE-0-2026-92715)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
    Summary
    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Credits
    owlmind
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Tutor LMS \u2013 eLearning and online course solution",
          "vendor": "themeum",
          "versions": [
            {
              "lessThanOrEqual": "4.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "owlmind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the \u0027ID\u0027 parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors \u2014 overwriting their title, content, and status \u2014 and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including \u0027ID\u0027) without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:27.343Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12f093bd-5230-4103-b571-80543c1b43cf?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.8/classes/Course.php#L1053"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.8/classes/Course.php#L1009"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.8/classes/Course.php#L850"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.8/classes/Course.php#L303"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3730615/tutor/trunk/classes/Course.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-16T17:06:38.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:55:54.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Tutor LMS \u003c= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via \u0027ID\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-92715",
    "datePublished": "2026-10-17T03:43:27.343Z",
    "dateReserved": "2026-09-16T16:51:34.440Z",
    "dateUpdated": "2026-10-17T03:43:27.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-107752 (GCVE-0-2026-107752)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie
    Summary
    The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / searchSkuSql)' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
    Severity
    4.9 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    uscnanbu Welcart e-Commerce Affected: 0 , ≤ 2.12.4 (semver)
    		Create a notification for this product.
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Welcart e-Commerce",
          "vendor": "uscnanbu",
          "versions": [
            {
              "lessThanOrEqual": "2.12.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the \u0027wp_usces_order_old (JSON fields searchSql / searchSkuSql)\u0027 parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:27.014Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0e78b5db-3f38-4ed7-9bec-6dd55d44f04f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.4/classes/orderList.class.php#L622"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.4/classes/orderList.class.php#L613"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.4/classes/orderList.class.php#L473"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.4/classes/orderList.class.php#L256"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.4/classes/orderList.class.php#L776"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3743211/usc-e-shop"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3743211/usc-e-shop/trunk/classes/orderList.class.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T19:03:04.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:35:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Welcart e-Commerce \u003c= 2.12.4 - Authenticated (Editor+) SQL Injection via \u0027wp_usces_order_old\u0027 Cookie"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-107752",
    "datePublished": "2026-10-17T03:43:27.014Z",
    "dateReserved": "2026-10-08T18:47:24.221Z",
    "dateUpdated": "2026-10-17T03:43:27.014Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109985 (GCVE-0-2026-109985)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter
    Summary
    The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "xSpeed Cache: AI-Powered Performance Hub with MCP, Caching \u0026 CDN",
          "vendor": "wpdevteam",
          "versions": [
            {
              "lessThanOrEqual": "1.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching \u0026 CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027content\u0027 parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:26.663Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d2f534b-804e-4def-bcc6-7418ad7d1ffd?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/xspeed/tags/1.4.2/includes/class-lazy-loader.php#L882"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/xspeed/tags/1.4.2/includes/class-lazy-loader.php#L879"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/xspeed/tags/1.4.2/includes/modules/Lazy/LazyModule.php#L197"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/xspeed/tags/1.4.2/includes/class-lazy-loader.php#L742"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3749755%40xspeed\u0026new=3749755%40xspeed"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-16T14:43:31.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "xSpeed Cache: AI-Powered Performance Hub with MCP, Caching \u0026 CDN \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027post_content\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109985",
    "datePublished": "2026-10-17T03:43:26.663Z",
    "dateReserved": "2026-10-13T12:21:38.781Z",
    "dateUpdated": "2026-10-17T03:43:26.663Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-110268 (GCVE-0-2026-110268)

    Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-17 03:43
    VLAI
    Title
    Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
    Summary
    The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outside of the originally intended directory. Exploitation requires the peiwm_enable_admin_download_buttons feature to be enabled in the plugin settings.
    Severity
    4.9 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    wpazleen Post Export Import with Media Affected: 0 , ≤ 1.17.2 (semver)
    		Create a notification for this product.
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post Export Import with Media",
          "vendor": "wpazleen",
          "versions": [
            {
              "lessThanOrEqual": "1.17.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the \u0027theme_slug\u0027 parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outside of the originally intended directory. Exploitation requires the peiwm_enable_admin_download_buttons feature to be enabled in the plugin settings."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:26.196Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/061b1f95-26da-4d1a-9e0a-6f83adf56d2e?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L251"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L360"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L360"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L251"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L258"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L357"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L258"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L357"
        },
        {
          "url": "https://plugins.svn.wordpress.org/post-export-import-with-media/trunk/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3749775/post-export-import-with-media/trunk/includes/class-admin-download-buttons.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-13T19:08:29.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:43:02.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post Export Import with Media \u003c= 1.17.2 - Authenticated (Administrator+) Path Traversal via \u0027theme_slug\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-110268",
    "datePublished": "2026-10-17T03:43:26.196Z",
    "dateReserved": "2026-10-13T18:53:06.476Z",
    "dateUpdated": "2026-10-17T03:43:26.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-111602 (GCVE-0-2026-111602)

    Vulnerability from cvelistv5 – Published: 2026-10-17 02:31 – Updated: 2026-10-17 02:31
    VLAI
    Title
    Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
    Summary
    The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode).
    Severity
    3.7 (Low)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Credits
    Jiří Fryjauf (jfryjauf)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
          "vendor": "latepoint",
          "versions": [
            {
              "lessThanOrEqual": "5.7.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ji\u0159\u00ed Fryjauf (jfryjauf)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the \u0027params (customer[uuid])\u0027 parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the \u0027Field used for authentication\u0027 setting set to \u0027Disable ability to login\u0027 (guest checkout mode)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:31:07.048Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6afce24f-30cd-4aeb-a5dd-20bd80a75779?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/steps_helper.php#L1175"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/steps_controller.php#L355"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/models/model.php#L379"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/params_helper.php#L14"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/controllers/steps_controller.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T22:13:58.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:30:46.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Appointment Booking Plugin \u003c= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in \u0027customer[uuid]\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-111602",
    "datePublished": "2026-10-17T02:31:07.048Z",
    "dateReserved": "2026-10-16T14:30:12.558Z",
    "dateUpdated": "2026-10-17T02:31:07.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-110653 (GCVE-0-2026-110653)

    Vulnerability from cvelistv5 – Published: 2026-10-17 02:31 – Updated: 2026-10-17 02:31
    VLAI
    Title
    Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
    Summary
    The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.
    Severity
    9.1 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    CWE
    • CWE-287 - Improper Authentication
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Credits
    Ekene Umegakwe
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
          "vendor": "latepoint",
          "versions": [
            {
              "lessThanOrEqual": "5.7.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ekene Umegakwe"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts \u003c 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers \u2014 who know a target customer\u0027s registered email address or phone number \u2014 to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:31:06.697Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/61fbc1dd-06c9-409b-8cad-3f350b38dfc3?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L228"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L185"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/auth_controller.php#L30"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/auth_controller.php#L14"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/models/model.php#L773"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/otp_helper.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-14T13:23:22.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:24:52.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Appointment Booking Plugin \u003c= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-110653",
    "datePublished": "2026-10-17T02:31:06.697Z",
    "dateReserved": "2026-10-14T13:08:07.307Z",
    "dateUpdated": "2026-10-17T02:31:06.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109208 (GCVE-0-2026-109208)

    Vulnerability from cvelistv5 – Published: 2026-10-17 02:31 – Updated: 2026-10-17 02:31
    VLAI
    Title
    LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
    Summary
    The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Credits
    daroo
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daroo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027quantity (REST) / order_comments (checkout)\u0027 parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:31:06.356Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac1ddf0-9164-45a8-b1dc-e684b1b4b447?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/admin/views/meta-boxes/order/content-tab-preview-exports-invoice.php#L86"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/rest-api/v1/frontend/class-lp-rest-courses-controller.php#L671"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/cart/class-lp-cart.php#L108"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/order/class-lp-order.php#L688"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/class-lp-checkout.php#L390"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/admin/views/meta-boxes/order/details.php#L218"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/assets/src/js/admin/order/refund-order.js#L104"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3750024%40learnpress\u0026new=3750024%40learnpress"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T13:45:10.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:28:58.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via \u0027quantity\u0027 and \u0027order_comments\u0027 Parameters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109208",
    "datePublished": "2026-10-17T02:31:06.356Z",
    "dateReserved": "2026-10-12T13:29:03.923Z",
    "dateUpdated": "2026-10-17T02:31:06.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-111601 (GCVE-0-2026-111601)

    Vulnerability from cvelistv5 – Published: 2026-10-17 02:31 – Updated: 2026-10-17 02:31
    VLAI
    Title
    Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter
    Summary
    The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The URL path regex constrains the path segment to word characters, but WP_REST_Request's query-string parameter precedence allows a ?token_id= value to override it and reach the handler verbatim, bypassing the regex constraint entirely.
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    hippooo Hippoo Mobile App for WooCommerce Affected: 0 , ≤ 1.12.0 (semver)
    		Create a notification for this product.
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Hippoo Mobile App for WooCommerce",
          "vendor": "hippooo",
          "versions": [
            {
              "lessThanOrEqual": "1.12.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027token_id\u0027 parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The URL path regex constrains the path segment to word characters, but WP_REST_Request\u0027s query-string parameter precedence allows a ?token_id= value to override it and reach the handler verbatim, bypassing the regex constraint entirely."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:31:06.019Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9c41af-0211-4a53-9ef4-b9392b2e9463?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/hippoo/tags/1.12.0/app/rest.php#L424"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/hippoo/tags/1.12.0/app/rest.php#L422"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/hippoo/tags/1.12.0/app/rest.php#L189"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3739429/hippoo/trunk/app/rest.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-09T15:21:16.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:24:48.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Hippoo Mobile App for WooCommerce \u003c= 1.12.0 - Reflected Cross-Site Scripting via \u0027token_id\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-111601",
    "datePublished": "2026-10-17T02:31:06.019Z",
    "dateReserved": "2026-10-16T14:23:53.339Z",
    "dateUpdated": "2026-10-17T02:31:06.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-104734 (GCVE-0-2026-104734)

    Vulnerability from cvelistv5 – Published: 2026-10-17 02:31 – Updated: 2026-10-17 02:31
    VLAI
    Title
    Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
    Summary
    The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-502 - Deserialization of Untrusted Data
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kirki \u2013 Freeform Page Builder, Website Builder \u0026 Customizer",
          "vendor": "themeum",
          "versions": [
            {
              "lessThanOrEqual": "6.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Kirki \u2013 Freeform Page Builder, Website Builder \u0026 Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin\u0027s import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:31:05.687Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c760235-ee53-4906-9e25-19df85b8f8ff?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/ExportImport/TemplateImport.php#L987"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/ExportImport/TemplateImport.php#L963"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/Ajax/TemplateExportImport.php#L35"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/Ajax.php#L802"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3743904/kirki/trunk/includes/ExportImport/TemplateImport.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T12:05:39.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:23:56.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Kirki \u003c= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104734",
    "datePublished": "2026-10-17T02:31:05.687Z",
    "dateReserved": "2026-10-02T11:49:39.157Z",
    "dateUpdated": "2026-10-17T02:31:05.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-107762 (GCVE-0-2026-107762)

    Vulnerability from cvelistv5 – Published: 2026-10-17 02:31 – Updated: 2026-10-17 02:31
    VLAI
    Title
    Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
    Summary
    The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Credits
    Md. Moniruzzaman Prodhan (NomanProdhan)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kirki \u2013 Freeform Page Builder, Website Builder \u0026 Customizer",
          "vendor": "themeum",
          "versions": [
            {
              "lessThanOrEqual": "6.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Md. Moniruzzaman Prodhan (NomanProdhan)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Kirki \u2013 Freeform Page Builder, Website Builder \u0026 Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the \u0027context\u0027 parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users\u0027 sensitive profile data \u2014 including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys \u2014 via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:31:05.352Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1f2fd69f-d432-4eb2-9d28-cfd7dd100e82?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/API/Frontend/Controllers/CollectionController.php#L179"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/API/Frontend/Controllers/FrontendRESTController.php#L64"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/Frontend/Preview/Utils.php#L466"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/HelperFunctions.php#L1152"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3743904/kirki/trunk/includes/API/Frontend/Controllers/CollectionController.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T19:25:20.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:25:22.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Kirki \u003c= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via \u0027context\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-107762",
    "datePublished": "2026-10-17T02:31:05.352Z",
    "dateReserved": "2026-10-08T19:09:59.739Z",
    "dateUpdated": "2026-10-17T02:31:05.352Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-107763 (GCVE-0-2026-107763)

    Vulnerability from cvelistv5 – Published: 2026-10-17 02:31 – Updated: 2026-10-17 02:31
    VLAI
    Title
    Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook
    Summary
    The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2309 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    hostspa Fastcache by Host.it Affected: 0 , ≤ 1.7.5 (semver)
    		Create a notification for this product.
    Credits
    Wordfence PRISM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Fastcache by Host.it",
          "vendor": "hostspa",
          "versions": [
            {
              "lessThanOrEqual": "1.7.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add or remove the plugin\u0027s page-cache rewrite rules in the site\u0027s root .htaccess file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:31:04.849Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1f0b4db0-2ccd-47e8-8f40-82e97726f815?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Admin.php#L304"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Admin.php#L44"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Core/Platform/Utility.php#L372"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3737013%40fastcache-by-host-it\u0026new=3737013%40fastcache-by-host-it"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-09T04:48:47.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Fastcache by Host.it \u003c= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-107763",
    "datePublished": "2026-10-17T02:31:04.849Z",
    "dateReserved": "2026-10-08T19:10:07.035Z",
    "dateUpdated": "2026-10-17T02:31:04.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-111855 (GCVE-0-2026-111855)

    Vulnerability from cvelistv5 – Published: 2026-10-17 02:09 – Updated: 2026-10-17 02:09
    VLAI
    Summary
    An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 28/100 over 2350 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Tektronix 3 Series MDO Affected: 0 , < 1.21.1 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "3 Series MDO",
          "vendor": "Tektronix",
          "versions": [
            {
              "lessThan": "1.21.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:09:21.352Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.tek.com/en/products/oscilloscopes/3-series-mdo"
        },
        {
          "url": "https://download.tek.com/document/TEK-PSA-002-092026.pdf"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-111855",
    "datePublished": "2026-10-17T02:09:21.352Z",
    "dateReserved": "2026-10-17T01:06:42.131Z",
    "dateUpdated": "2026-10-17T02:09:21.352Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-111854 (GCVE-0-2026-111854)

    Vulnerability from cvelistv5 – Published: 2026-10-17 02:08 – Updated: 2026-10-17 02:08
    VLAI
    Summary
    An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.
    Severity
    8.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 28/100 over 2350 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Tektronix 3 Series MDO Affected: 0 , < 1.21.1 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "3 Series MDO",
          "vendor": "Tektronix",
          "versions": [
            {
              "lessThan": "1.21.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:08:50.037Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.tek.com/en/products/oscilloscopes/3-series-mdo"
        },
        {
          "url": "https://download.tek.com/document/TEK-PSA-002-092026.pdf"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-111854",
    "datePublished": "2026-10-17T02:08:50.037Z",
    "dateReserved": "2026-10-17T01:04:40.618Z",
    "dateUpdated": "2026-10-17T02:08:50.037Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-111853 (GCVE-0-2026-111853)

    Vulnerability from cvelistv5 – Published: 2026-10-17 02:08 – Updated: 2026-10-17 02:08
    VLAI
    Summary
    An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 28/100 over 2350 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Tektronix 3 Series MDO Affected: 0 , < 1.21.1 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "3 Series MDO",
          "vendor": "Tektronix",
          "versions": [
            {
              "lessThan": "1.21.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:08:13.787Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.tek.com/en/products/oscilloscopes/3-series-mdo"
        },
        {
          "url": "https://download.tek.com/document/TEK-PSA-002-092026.pdf"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-111853",
    "datePublished": "2026-10-17T02:08:13.787Z",
    "dateReserved": "2026-10-17T01:02:29.939Z",
    "dateUpdated": "2026-10-17T02:08:13.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-111823 (GCVE-0-2026-111823)

    Vulnerability from cvelistv5 – Published: 2026-10-16 23:16 – Updated: 2026-10-16 23:16
    VLAI
    Summary
    Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-390 - Detection of Error Condition Without Action
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 28/100 over 2350 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mage mage-ai Affected: 0 , ≤ 0.9.80 (semver)
        cpe:2.3:a:mage:mage-ai:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "mage-ai",
          "repo": "https://github.com/mage-ai/mage-ai",
          "vendor": "Mage",
          "versions": [
            {
              "lessThanOrEqual": "0.9.80",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mage:mage-ai:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.9.80",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-390",
              "description": "CWE-390 Detection of Error Condition Without Action",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T23:16:29.244Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/mage-ai/mage-ai/pull/6204"
        },
        {
          "url": "https://github.com/mage-ai/mage-ai/pull/6205"
        },
        {
          "url": "https://github.com/mage-ai/mage-ai/pull/6204/changes/76c4f467f3654041d8899b1c4447a985710d26c0"
        },
        {
          "url": "https://thecoregroup.net/category/the-core-group/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "On 2026-10-16, Mage merged PR #6204 (4fc5e1860260c4f772d852a28323eb65405178df) to reject unverified OAuth identities and PR #6205 (4a8904fcd2765859bd4e2b87fb284dabddb13c83) to harden version-control command execution and subprocess timeout/cancellation. These address the reported authentication bypass and shell-injection path in source. PR #6207 (9c6331991c5e6e43d755bd59c151864ef28fdc11) also removes the four version-control policy overrides used by the zero-role chain. No fixed released package or container image has been established; PyPI 0.9.80 predates these merges."
            }
          ],
          "value": "On 2026-10-16, Mage merged PR #6204 (4fc5e1860260c4f772d852a28323eb65405178df) to reject unverified OAuth identities and PR #6205 (4a8904fcd2765859bd4e2b87fb284dabddb13c83) to harden version-control command execution and subprocess timeout/cancellation. These address the reported authentication bypass and shell-injection path in source. PR #6207 (9c6331991c5e6e43d755bd59c151864ef28fdc11) also removes the four version-control policy overrides used by the zero-role chain. No fixed released package or container image has been established; PyPI 0.9.80 predates these merges."
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-111823",
    "datePublished": "2026-10-16T23:16:29.244Z",
    "dateReserved": "2026-10-16T23:16:28.857Z",
    "dateUpdated": "2026-10-16T23:16:29.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-89096 (GCVE-0-2026-89096)

    Vulnerability from cvelistv5 – Published: 2026-10-16 23:06 – Updated: 2026-10-16 23:06
    VLAI
    Title
    Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
    Summary
    A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.
    Severity
    5.9 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
    CWE
    • CWE-772 - Missing Release of Resource after Effective Lifetime
    Assigner
    redhat CNA under the redhat root
    CNA scorecard B 82/100 over 1036 records in the last 180 days details
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-89096 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2462372 issue-trackingx_refsource_REDHAT
    Impacted products
    Date Public
    2026-10-16 22:47
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "nfs-utils",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "nfs-utils",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "nfs-utils",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "nfs-utils",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "nfs-utils",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-10-16T22:47:37.063Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-772",
              "description": "Missing Release of Resource after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T23:06:19.924Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-89096"
        },
        {
          "name": "RHBZ#2462372",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462372"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-26T18:58:13.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-16T22:47:37.063Z",
          "value": "Made public."
        }
      ],
      "title": "Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-772: Missing Release of Resource after Effective Lifetime"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-89096",
    "datePublished": "2026-10-16T23:06:19.924Z",
    "dateReserved": "2026-09-10T20:51:57.497Z",
    "dateUpdated": "2026-10-16T23:06:19.924Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-89088 (GCVE-0-2026-89088)

    Vulnerability from cvelistv5 – Published: 2026-10-16 23:06 – Updated: 2026-10-16 23:06
    VLAI
    Title
    Parted: parted: denial of service via heap buffer overflow during fat16 resize
    Summary
    A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).
    Severity
    5.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
    CWE
    Assigner
    redhat CNA under the redhat root
    CNA scorecard B 82/100 over 1036 records in the last 180 days details
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-89088 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2462951 issue-trackingx_refsource_REDHAT
    Impacted products
    Date Public
    2026-09-14 00:00
    Credits
    This issue was discovered by Found by AISLE in partnership with Red Hat.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "parted",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "parted",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "parted",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "parted",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "parted",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Found by AISLE in partnership with Red Hat."
        }
      ],
      "datePublic": "2026-09-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in parted. A heap-based buffer overflow exists in libparted\u0027s file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T23:06:18.907Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-89088"
        },
        {
          "name": "RHBZ#2462951",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462951"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-26T20:29:13.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-14T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Parted: parted: denial of service via heap buffer overflow during fat16 resize",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-787: Out-of-bounds Write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-89088",
    "datePublished": "2026-10-16T23:06:18.907Z",
    "dateReserved": "2026-09-10T20:05:11.746Z",
    "dateUpdated": "2026-10-16T23:06:18.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-89085 (GCVE-0-2026-89085)

    Vulnerability from cvelistv5 – Published: 2026-10-16 23:04 – Updated: 2026-10-16 23:04
    VLAI
    Title
    Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image
    Summary
    A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.
    Severity
    6.6 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
    CWE
    Assigner
    redhat CNA under the redhat root
    CNA scorecard B 82/100 over 1036 records in the last 180 days details
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-89085 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2466034 issue-trackingx_refsource_REDHAT
    Impacted products
    Date Public
    2026-09-14 00:00
    Credits
    Red Hat would like to thank AISLE Research for reporting this issue.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "parted",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "parted",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "parted",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "parted",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "parted",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank AISLE Research for reporting this issue."
        }
      ],
      "datePublic": "2026-09-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T23:04:28.673Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-89085"
        },
        {
          "name": "RHBZ#2466034",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466034"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-04T17:01:56.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-14T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-787: Out-of-bounds Write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-89085",
    "datePublished": "2026-10-16T23:04:28.673Z",
    "dateReserved": "2026-09-10T19:48:21.313Z",
    "dateUpdated": "2026-10-16T23:04:28.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-110759 (GCVE-0-2026-110759)

    Vulnerability from cvelistv5 – Published: 2026-10-16 22:08 – Updated: 2026-10-16 22:08
    VLAI
    Title
    Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse
    Summary
    Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error. A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
    Severity
    No CVSS data available.
    CWE
    • CWE-1286 - Improper Validation of Syntactic Correctness of Input
    Assigner
    CPANSec CNA under the redhat root
    CNA scorecard C 64/100 over 273 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Affected: 0 , < 1.65 (custom)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "Text::CSV_XS"
          ],
          "packageName": "Text-CSV_XS",
          "packageURL": "pkg:cpan/Text-CSV_XS",
          "programFiles": [
            "CSV_XS.xs"
          ],
          "programRoutines": [
            {
              "name": "Text::CSV_XS::parse"
            }
          ],
          "repo": "https://github.com/cpan-authors/Text-CSV_XS",
          "versions": [
            {
              "lessThan": "1.65",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.\n\nWhen the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse(\"a,\\r\") returns the fields \"a\" and \"\\xFF\". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.\n\nA CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1286",
              "description": "CWE-1286 Improper Validation of Syntactic Correctness of Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T22:08:23.781Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/cpan-authors/Text-CSV_XS/commit/7627f1a2bb8ffe4e81d9847318a060822043f7f3.patch"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Text-CSV_XS 1.65 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-14T00:00:00.000Z",
          "value": "Fix committed to upstream repository."
        },
        {
          "lang": "en",
          "time": "2026-10-15T00:00:00.000Z",
          "value": "Version 1.65 released with fix."
        }
      ],
      "title": "Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-110759",
    "datePublished": "2026-10-16T22:08:23.781Z",
    "dateReserved": "2026-10-14T17:07:54.223Z",
    "dateUpdated": "2026-10-16T22:08:23.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}