https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 23:58:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336409 EUVD-2026-336409 https://cve.radiocsirt.org/vuln/euvd-2026-336409 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11563 <p>The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php).</p> <p>The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-11563 https://cve.radiocsirt.org/vuln/ghsa-5pg8-pjj5-p2wc <p>The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php).</p> <p>The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php).</p> https://cve.radiocsirt.org/vuln/ghsa-5pg8-pjj5-p2wc