Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
cb1d4160 by security tracker role at 2026-10-11T07:13:26+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,339 +1,339 @@
CVE-2026-97853 (Memory Allocation with Excessive Size Value vulnerability in
ericmj de ...)
TODO: check
CVE-2026-97183 (The WP-Invoice WordPress plugin through 4.3.1 does not
perform capabi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96227 (The Piotnet Forms WordPress plugin through 1.0.30 does not
authenticat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94235 (The MemberHero WordPress plugin through 6.9 does not perform
any capa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93550 (The Veeqo for WooCommerce WordPress plugin through 2.2.8 does
not rest ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91829 (The Subscribe to Comments WordPress plugin before 2.3.3 does
not prope ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89305 (The paymendo WordPress plugin through 1.1 does not properly
sanitize ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89304 (The paymendo WordPress plugin through 1.1 does not properly
sanitize ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89302 (The Post Voting System WordPress plugin through 1.0 does not
properly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89299 (The WP Verify API WordPress plugin through 1.0.0 does not
properly san ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89297 (The Loja Autom\xe1tica WordPress plugin through 1.0.0 does not
properl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89287 (The ASPL Product Quotation WordPress plugin through 1.1.0 does
not san ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89285 (The Datalist it WordPress plugin through 0.0.3 does not
sanitize and e ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89283 (The WP Posts Password Batch Manager WordPress plugin through
1.1 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89234 (The WP-Partner WordPress plugin through 1.2.1 does not
sanitise and es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89232 (The Recordbrowser WordPress plugin through 1.1.7 does not
sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89214 (The WpCues Basic Quiz WordPress plugin through 1.6.5 does not
properly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89213 (The Llavero.io WordPress plugin through 0.1.4 does not
properly saniti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89195 (The Site Setup Wizard WordPress plugin through 1.5.8 does not
properly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88930 (The Social Web Suite WordPress plugin through 4.1.12 does not
require ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88905 (The KeyWord Collector WordPress plugin through 1.4 does not
have any a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88903 (The Topcontent WordPress plugin through 1.2.1 does not
properly author ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88827 (The Disable Users WordPress plugin through 1.0.5 does not
enforce its ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88826 (The SmugMug Embed WordPress plugin through 3.13 does not have
authoris ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88785 (The Simple Membership WordPress plugin before 4.8.3 does not
avoid tra ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87764 (The BuddyPress Instant Chat WordPress plugin through 1.6 does
not chec ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87762 (The Adwised Web Push Notification WordPress plugin through
2.5.7 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87761 (The Adwised Web Push Notification WordPress plugin through
2.5.7 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87760 (The Web Vitals Tracking WordPress plugin through 5.4.2 does
not valida ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86798 (The HootBoard WordPress plugin through 3.1.4 does not perform
any aut ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86717 (The Insurify WordPress plugin through 1.0 does not have
authorisation ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86706 (The Quick quotes WordPress plugin through 1.0.0 does not
perform any ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85126 (The Crowdfundly WordPress plugin through 2.2.2 does not have
capabilit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85121 (The Insurify WordPress plugin through 1.0 does not have
authorisation ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85118 (The AI Content Generator Marketing WordPress plugin through
1.0.0 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84737 (The Freeton WP WordPress plugin through 1.0.0 does not
correctly valid ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84734 (The Mindstien Quick Login WordPress plugin through 1.0 does
not correc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84261 (The click5 CRM add-on to Contact Form 7 WordPress plugin
through 1.0.4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84260 (The click5 CRM add-on to Gravity Forms WordPress plugin
through 1.0.3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84259 (The click5 CRM add-on to WPForms WordPress plugin through
1.0.3 does n ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84258 (The click5 CRM add-on to Ninja Forms WordPress plugin through
1.0.1 do ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84254 (The click5 CRM add-on to Contact Form 7 WordPress plugin
through 1.0.4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84253 (The click5 CRM add-on to Gravity Forms WordPress plugin
through 1.0.3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84252 (The click5 CRM add-on to WPForms WordPress plugin through
1.0.3 does n ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84251 (The click5 CRM add-on to Ninja Forms WordPress plugin through
1.0.1 do ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81797 (Unauthenticated PHP Object Injection in Buzz Stone | Magazine
& Viral ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81649 (The Fundiin cho WooCommerce WordPress plugin through 3.4.0
does not ha ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81420 (The Tcard WP WordPress plugin through 1.8.0 does not sanitise
and esca ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81156 (The Robo Gallery WordPress plugin before 5.2.6 does not
sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81155 (The Robo Gallery WordPress plugin before 5.2.6 does not
sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81154 (The Robo Gallery WordPress plugin before 5.2.6 does not
sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81153 (The Robo Gallery WordPress plugin before 5.2.6 does not
sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78535 (Unauthenticated PHP Object Injection in Photolia <= 1.0.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78534 (Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78533 (Unauthenticated PHP Object Injection in Qwery <= 3.6.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78532 (Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78531 (Unauthenticated PHP Object Injection in Jacqueline <= 2.22
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78530 (Subscriber Arbitrary File Deletion in FoodBakery <= 4.6
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78529 (Unauthenticated PHP Object Injection in Alliance <= 3.11
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66569 (Unauthenticated PHP Object Injection in Kicker <= 2.2.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66568 (Unauthenticated PHP Object Injection in Original <= 1.9.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66567 (Unauthenticated PHP Object Injection in Anesta <= 1.5.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66566 (Unauthenticated Local File Inclusion in Ambient <= 1.7
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66565 (Unauthenticated PHP Object Injection in FC United <= 1.1.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66564 (Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66563 (Unauthenticated PHP Object Injection in Windsor <= 2.10
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66483 (Unauthenticated PHP Object Injection in Education Center <=
3.6.12 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66482 (Unauthenticated PHP Object Injection in Drone Media <= 2.2.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66481 (Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66480 (Exposure of Sensitive System Information to an Unauthorized
Control Sp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-65459 (Unauthenticated Arbitrary Content Deletion in Forminator <=
1.57.3 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62130 (Shop manager PHP Object Injection in WooCommerce Multilingual
& Multic ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62129 (Contributor Arbitrary File Upload in Creator LMS <= 1.2.21
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62125 (Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62124 (Unauthenticated PHP Object Injection in N7 | Golf Club Sports
& Events ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62123 (Unauthenticated PHP Object Injection in Invetex <= 2.18
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62120 (Unauthenticated PHP Object Injection in Law Office <= 3.20
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62118 (Unauthenticated Broken Access Control in Barcode Scanner with
Inventor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62117 (Subscriber SQL Injection in Barcode Scanner with Inventory &
Order Man ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62116 (Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner
with Inv ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62115 (Unauthenticated Local File Inclusion in KuteShop <= 4.2.9
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62100 (Unauthenticated Cross Site Scripting (XSS) in KuteShop <=
4.2.9 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62099 (Unauthenticated Local File Inclusion in Boutique <= 2.3.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62098 (Unauthenticated Content Injection in Boutique <= 2.3.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62096 (Unauthenticated Local File Inclusion in Biolife <= 3.2.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62095 (Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62094 (Unauthenticated Local File Inclusion in TechOne <= 3.0.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62093 (Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62092 (Unauthenticated Local File Inclusion in Armania <= 1.4.8
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62091 (Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62090 (Unauthenticated PHP Object Injection in WineShop <= 3.20
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62087 (Unauthenticated PHP Object Injection in Equadio <= 1.1.4
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62086 (Unauthenticated PHP Object Injection in Juno <= 2.25 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62082 (Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62077 (Unauthenticated PHP Object Injection in Avala <= 1.1.4
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62076 (Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62075 (Unauthenticated Local File Inclusion in Backhoe <= 2.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62074 (Unauthenticated Local File Inclusion in Ozeum <= 1.3.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62070 (Unauthenticated Local File Inclusion in Flipmart <= 2.8
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62069 (Unauthenticated Local File Inclusion in Fabius <= 1.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62068 (Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62067 (Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62066 (Unauthenticated Local File Inclusion in Volos <= 1.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62065 (Unauthenticated Local File Inclusion in Cardea <= 2.3
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62064 (Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62054 (Unauthenticated PHP Object Injection in Yacht Rental <= 2.6
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62053 (Unauthenticated PHP Object Injection in Wine House <= 3.20
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62052 (Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62051 (Unauthenticated PHP Object Injection in Stargaze <= 1.10
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62050 (Unauthenticated PHP Object Injection in Splendour <= 1.23
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62043 (Unauthenticated Sensitive Data Exposure in Contact Form 7
\u2013 Dynam ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62038 (Unauthenticated Broken Authentication in eRoom <= 1.7.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62037 (Unauthenticated Cross Site Scripting (XSS) in Document
Embedder <= 2.4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62035 (Subscriber Broken Access Control in AWS S3 for WordPress
Plugin \u2013 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62034 (Unauthenticated Cross Site Scripting (XSS) in Before After
Image Compa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62033 (Subscriber Settings Change in uListing <= 2.2.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62032 (Unauthenticated Local File Inclusion in DirectoryPress <=
3.6.27 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62031 (Unauthenticated SQL Injection in uListing <= 2.2.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62030 (Unauthenticated Server Side Request Forgery (SSRF) in
StreamCast <= 2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62027 (Unauthenticated Cross Site Scripting (XSS) in Team Section
Block <= 2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62025 (Unauthenticated Arbitrary File Upload in Tailored Tools <=
3.0.3 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62024 (Subscriber Arbitrary File Upload in CodeBard Help Desk <=
1.1.2 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62022 (Unauthenticated Privilege Escalation in Tonda Membership <=
1.0.1 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62021 (Subscriber PHP Object Injection in Angio <= 1.1.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62020 (Unauthenticated Local File Inclusion in TouchUp < 1.4
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57742 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48194 (Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48193 (Unauthenticated Local File Inclusion in Uminex <= 1.0.9
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-45440 (Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2
version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42777 (Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42724 (Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42723 (Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42722 (Administrator SQL Injection in Frontend Admin by DynamiApps <=
3.29.13 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42719 (Subscriber PHP Object Injection in Dynamic User Directory <=
2.4 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42718 (Unauthenticated PHP Object Injection in Booster for
WooCommerce <= 8.4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42717 (Administrator SQL Injection in Leyka <= 3.32.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42716 (Unauthenticated PHP Object Injection in Payever - WooCommerce
Gateway ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42715 (Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by
10Web < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42712 (Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42711 (Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web
<= 1.2.6 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42709 (Unauthenticated Cross Site Scripting (XSS) in Food Menu \u2013
Restaur ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42706 (Unauthenticated Broken Access Control in DK <= 3.2.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42705 (Unauthenticated Broken Access Control in Grand News <= 3.4
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42704 (Unauthenticated Local File Inclusion in Kids Care <= 3.2.4
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42702 (Unauthenticated Cross Site Scripting (XSS) in Tutor LMS <=
4.1.0 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42699 (Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <=
8.1.8 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42697 (Unauthenticated Cross Site Scripting (XSS) in Social Share
Icons & Soc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42696 (Unauthenticated Remote Code Execution (RCE) in SiteVault
\u2013 Backup ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42693 (Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5
versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42633 (Subscriber SQL Injection in Events Manager <= 7.4.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42632 (Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate
<= 1.1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42631 (Unauthenticated Cross Site Scripting (XSS) in Qode Music <=
2.1.8.2 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42630 (Unauthenticated Sensitive Data Exposure in Web Plura Backup
& Rest ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42419 (Unauthenticated Sensitive Data Exposure in Swish Migrate and
Backup <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40808 (Subscriber Broken Access Control in Jetpack VideoPress <= 3.6
versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40805 (Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40803 (Unauthenticated Cross Site Scripting (XSS) in Jotform –
AI Chatb ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40802 (Subscriber Settings Change in Pubjet |
\u067e\u0627\u0628\u062c\u062a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40801 (Subscriber Broken Access Control in Wordable <= 8.2.10
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40800 (Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk
Edit Produc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40777 (Subscriber Broken Access Control in WPSection <= 1.5.1
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39802 (Unauthenticated Remote Code Execution (RCE) in Everest Backup
<= 2.3.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39801 (Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39800 (Unauthenticated Cross Site Scripting (XSS) in Additional Order
Filters ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39799 (Unauthenticated Cross Site Scripting (XSS) in WP File Download
<= 6.3. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27350 (Server-Side Request Forgery (SSRF) vulnerability in
Builderius.io Buil ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-14854 (The WooCommerce Bookings WordPress plugin before 3.11.0 does
not limit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12980 (The Post Snippets WordPress plugin through 4.2.4 does not
properly es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108708 (Wukong_HRM through commit 186115e contains a missing
authorization vul ...)
TODO: check
CVE-2026-108707 (Wukong_HRM through commit 186115e contains an authentication
bypass vu ...)
@@ -543,35 +543,35 @@ CVE-2026-108522 (A vulnerability was found in
Studio-Saelix Sencho up to 0.94.1.
CVE-2026-108521 (A vulnerability has been found in Studio-Saelix Sencho up to
0.97.1. A ...)
TODO: check
CVE-2026-107694 (The Dokan: AI Powered WooCommerce Multivendor Marketplace
Solution Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107507 (The Squadeno WordPress plugin before 1.12.0 does not enforce
its rest ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107434 (Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9
versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-107420 (Unauthenticated Bypass Vulnerability in Pay With MetaMask For
WooComme ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106029 (The WeddingCity Lite WordPress plugin through 1.0.4 does not
perform ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104841
REJECTED
CVE-2026-104684 (The Envira Gallery WordPress plugin before 1.16.2 does not
verify tha ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104682 (The Envira Gallery WordPress plugin before 1.16.2 does not
correctly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104681 (The Envira Gallery WordPress plugin before 1.16.2 does not
verify tha ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104680 (The Envira Gallery WordPress plugin before 1.16.2 does not
verify tha ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104028 (The Anton Extensions WordPress plugin through 1.2.2 does not
perform a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103695 (The Mobile builder WordPress plugin through 1.4.2 does not
sanitise an ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103694 (The Mobile builder WordPress plugin through 1.4.2 does not
properly re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103685 (Missing Authorization vulnerability in VillaTheme ALD \u2013
Dropshipp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103305 (The Prenotazioni WordPress plugin through 1.7.5 does not have
authoris ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97396 (The Email Marketing for WordPress and WooCommerce \u2013
Retainful plu ...)
NOT-FOR-US: WordPress plugin
CVE-2026-97340 (The Avada | Website Builder For WordPress & WooCommerce theme
for Word ...)
@@ -760,13 +760,13 @@ CVE-2026-104722 (The Listdom: AI-powered Business
Directory with Classifieds Ads
CVE-2026-104398 (Deserialization of Untrusted Data vulnerability in VillaTheme
AFFI \u2 ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-103636 (Out-of-bounds read in the VarOpt union deserialization of
Apache DataS ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103635 (Out-of-bounds read in the compact Theta sketch
deserialization of Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103513 (Out-of-bounds read and write in the CPC sketch
deserialization of Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103501 (Heap buffer overflow in the HLL sketch deserialization of
Apache DataS ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103478 (The Premium Packages \u2013 Sell Digital Products Securely
plugin for ...)
NOT-FOR-US: WordPress plugin
CVE-2026-103357 (Missing Authorization vulnerability in VillaTheme GIFT4U
gift4u-gift-c ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cb1d416039eb734469db1136cd4b7e05ed198a9c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cb1d416039eb734469db1136cd4b7e05ed198a9c
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
