آخرین آسیب‌پذیری‌ها
| شناسه | شدت | شرح | EPSS | انتشار |
|---|---|---|---|---|
| CVE-2026-76012 | 7.5بالا |
Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload
smub Photo Gallery
|
۰٫۸۲٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-119113 | 6.4متوسط |
GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter
paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
|
۰٫۳۶٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-105894 | 8.8بالا |
Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update
akbilisim Ak Framework
|
۰٫۳۱٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-115869 | 6.4متوسط |
Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
themifyme Themify Builder
|
۰٫۲۹٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-109984 | 5.4متوسط |
FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments
foliovision FV Flowplayer Video Player
|
۰٫۴٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-104744 | 7.2بالا |
Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
Independent Analytics Pro
|
۰٫۲۸٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-112365 | 7.2بالا |
easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter
wpdevteam easy.jobs – AI powered Job Listing
|
۰٫۵۲٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-115346 | 8.1بالا |
Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field
ThemeFusion Avada | Website Builder For WordPress & WooCommerce
|
۰٫۶۶٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-115820 | 6.5متوسط |
Majestic Support <= 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'columns' Parameter
ahmadmj Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
|
۰٫۴۲٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-118205 | 7.4بالا |
Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision
wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
|
۰٫۴۶٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-109592 | 4.3متوسط |
OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placem…
wordpressdotorg OpenStation – Admin Dashboard Notes
|
۰٫۳۴٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-102918 | 6.4متوسط |
Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id
davidanderson Redux Framework
|
۰٫۳۱٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-102905 | 6.5متوسط |
Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter
spacetime Ad Inserter – Ad Manager & AdSense Ads
|
۰٫۴۲٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-110533 | 6.4متوسط |
FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes
foliovision FV Flowplayer Video Player
|
۰٫۳۲٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-104739 | 4.9متوسط |
JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter
rabilal JS Help Desk – AI-Powered Support & Ticketing System
|
۰٫۷۸٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-96894 | 7.2بالا |
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
wedevs ERP: Complete HR
|
۰٫۳۷٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-97638 | 7.5بالا |
Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter
WPMU DEV Forminator Forms – Contact Form
|
۰٫۵۶٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-118635 | 6.5متوسط |
GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter
paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
|
۰٫۴۳٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-107630 | 7.5بالا |
Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter
Saad Iqbal Email Templates Customizer and Designer for WordPress and WooCommerce
|
۰٫۵٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-9239 | 6.4متوسط |
Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)
tigroumeow Meow Gallery
|
۰٫۳۲٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-116552 | 4.7متوسط |
Like Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header
LikeBtn Like Button Rating ♥ LikeBtn
|
۰٫۳٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-110305 | 7.5بالا |
Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection
hwk-fr Advanced Custom Fields: Extended
|
۰٫۶۱٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-110001 | 5.4متوسط |
FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute
foliovision FV Flowplayer Video Player
|
۰٫۳۴٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2025-8574 | 8.7بالا |
Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion
tigroumeow Database Cleaner: Cleanup
|
۰٫۳۶٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|
| CVE-2026-13747 | 6.5متوسط |
Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint
tigroumeow Meow Gallery
|
۰٫۳۹٪ |
۱۴۰۵/۰۸/۰۸
۷ روز پیش
|