https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:28:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-331551 EUVD-2026-331551 https://cve.radiocsirt.org/vuln/euvd-2026-331551 https://cve.radiocsirt.org/vuln/fkie_cve-2026-10096 <p>The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the &#39;page_id&#39; parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify the stored Qi Blocks styles of arbitrary posts, templates, or widgets they do not own — including site-wide surfaces via the reserved &#39;template&#39; and &#39;widget&#39; page_id values — enabling unauthorized frontend defacement, content hiding, and degradation of any page on the site. The endpoint&#39;s permission_callback checks only the generic edit_posts and publish_posts capabilities, meaning any user with the built-in Author role satisfies the check regardless of post ownership.</p> <p>The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the &#39;page_id&#39; parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify the stored Qi Blocks styles of arbitrary posts, templates, or widgets they do not own — including site-wide surfaces via the reserved &#39;template&#39; and &#39;widget&#39; page_id values — enabling unauthorized frontend defacement, content hiding, and degradation of any page on the site. The endpoint&#39;s permission_callback checks only the generic edit_posts and publish_posts capabilities, meaning any user with the built-in Author role satisfies the check regardless of post ownership.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-10096 https://cve.radiocsirt.org/vuln/ghsa-69gg-pvp7-2fx5 <p>The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the &#39;page_id&#39; parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify the stored Qi Blocks styles of arbitrary posts, templates, or widgets they do not own — including site-wide surfaces via the reserved &#39;template&#39; and &#39;widget&#39; page_id values — enabling unauthorized frontend defacement, content hiding, and degradation of any page on the site. The endpoint&#39;s permission_callback checks only the generic edit_posts and publish_posts capabilities, meaning any user with the built-in Author role satisfies the check regardless of post ownership.</p> <p>The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the &#39;page_id&#39; parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify the stored Qi Blocks styles of arbitrary posts, templates, or widgets they do not own — including site-wide surfaces via the reserved &#39;template&#39; and &#39;widget&#39; page_id values — enabling unauthorized frontend defacement, content hiding, and degradation of any page on the site. The endpoint&#39;s permission_callback checks only the generic edit_posts and publish_posts capabilities, meaning any user with the built-in Author role satisfies the check regardless of post ownership.</p> https://cve.radiocsirt.org/vuln/ghsa-69gg-pvp7-2fx5