آخرین آسیب‌پذیری‌ها
| شناسه | شدت | شرح | EPSS | انتشار |
|---|---|---|---|---|
| CVE-2026-88942 | 6.1متوسط |
Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter
woobewoo Product Filter for WooCommerce by WBW
|
۰٫۲۷٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-119980 | 6.5متوسط |
UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash
stiofansisland UsersWP – Front-end login form
|
۰٫۲۶٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-90960 | 5.3متوسط |
Seraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory
seraphinitesoft Seraphinite Accelerator
|
۰٫۳۲٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-119162 | 7.2بالا |
User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting
specialk User Submitted Posts – Enable Users to Submit Posts from the Front End
|
۰٫۲۴٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-107765 | 6.4متوسط |
Discussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field
MarketingFire Discussion Board – WordPress Forum Plugin
|
۰٫۱۹٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-120040 | 7.5بالا |
Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure
wardee Mail logging & Catcher
|
۰٫۲۸٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-116546 | 6.4متوسط |
WP Job Portal <= 2.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'degreetitle' Parameter
wpjobportal WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
|
۰٫۲٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-116522 | 7.2بالا |
Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode
comesio Relevanssi – A Better Search
|
۰٫۲۴٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-119089 | 7.2بالا |
ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag
supercleanse ThirstyAffiliates – Affiliate Links
|
۰٫۲۳٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-120019 | 5.4متوسط |
W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder
boldgrid W3 Total Cache
|
۰٫۲۲٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-107653 | 7.2بالا |
SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments
SureCart – Ecommerce Made Easy For Selling Physical Products
|
۰٫۲۸٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-119163 | 7.5بالا |
FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter
teamfunnelkit FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
|
۰٫۳٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-109220 | 9.8بحرانی |
PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field
add-ons.org PDF Invoice for WooCommerce + Drag and Drop Template Builder
|
۰٫۵۲٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-89270 | 9.1بحرانی |
Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters
popupbuilder Popup Builder – Create highly converting
|
۰٫۳۹٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-111109 | 6.1متوسط |
Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag
pfefferle Webmention
|
۰٫۲۸٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-111254 | 7.2بالا |
W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
boldgrid W3 Total Cache
|
۰٫۳٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-94361 | 5.3متوسط |
PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback
|
۰٫۲۲٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-82214 | 5.3متوسط |
Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download
|
۰٫۲۵٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-118638 | 7.5بالا |
Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route
|
۰٫۲۵٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-118629 | 5.3متوسط |
All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure
|
۰٫۲۵٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-118438 | 6.8متوسط |
Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute
|
۰٫۲۹٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-118437 | 3.7پایین |
BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion
|
۰٫۲٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-118185 | 7.5بالا |
Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting
|
۰٫۲۸٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-118184 | 5.3متوسط |
Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation
|
۰٫۲۱٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|
| CVE-2026-118043 | 7.2بالا |
Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal
|
۰٫۲۳٪ |
۱۴۰۵/۰۸/۰۹
۳ روز پیش
|