CVE-2026-115259
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes…
İçeriği inceleyinALLSAFE / Güncel Güvenlik AçıklarıGelişmeleri izleyin.
Gelişmeleri izleyin.
Riskleri önceliklendirin.
NIST NVD, USOM / Siber Güvenlik Başkanlığı ve Exploit-DB kaynaklarından güvenlik bildirimleri. Etkilenen ürün ve sürümleri özgün kaynakta doğrulayın.
Kayıtlar kaynakların yayın tarihleri ve özgün içerikleriyle sunulur. Bir kaydın bulunması, kurumunuzun etkilendiğini tek başına göstermez. Sürüm ve yapılandırmayı kontrol ederek üreticinin güncel önerilerini değerlendirin.
CVE-2026-115282
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose…
İçeriği inceleyinCVE-2026-115299
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound…
İçeriği inceleyinCVE-2026-115300
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and…
İçeriği inceleyinCVE-2026-110030
The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a…
İçeriği inceleyinCVE-2026-110504
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and…
İçeriği inceleyinCVE-2026-110505
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript:…
İçeriği inceleyinCVE-2026-110983
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete…
İçeriği inceleyinCVE-2026-111739
The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account…
İçeriği inceleyinCVE-2026-113616
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in…
İçeriği inceleyinCVE-2026-113617
The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with…
İçeriği inceleyinCVE-2026-114270
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published…
İçeriği inceleyin