https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T12:55:22.887375+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2021-99630 cnvd-2021-99630 2026-10-07T12:55:22.954021+00:00 cnvd-2021-99630 https://cve.radiocsirt.org/vuln/euvd-2026-24019 EUVD-2026-24019 2026-10-07T12:55:22.954062+00:00 EUVD-2026-24019 https://cve.radiocsirt.org/vuln/fkie_cve-2021-24626 fkie_cve-2021-24626 2026-10-07T12:55:22.954077+00:00

The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection

 https://cve.radiocsirt.org/vuln/ghsa-55v2-rhxp-258p GHSA-55v2-rhxp-258p 2026-10-07T12:55:22.954109+00:00

The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection

 https://cve.radiocsirt.org/vuln/gsd-2021-24626 gsd-2021-24626 2026-10-07T12:55:22.954127+00:00 gsd-2021-24626