https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:25:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318947 EUVD-2026-318947 https://cve.radiocsirt.org/vuln/euvd-2026-318947 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6403 <p>The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply_zip_theme() function, which appends a user-controlled &#39;stylesheet&#39; parameter directly to the theme root directory path without sanitizing directory traversal sequences. This makes it possible for unauthenticated attackers to trigger the creation of a ZIP archive containing arbitrary files from the server&#39;s filesystem — including wp-config.</p> <p>The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply_zip_theme() function, which appends a user-controlled &#39;stylesheet&#39; parameter directly to the theme root directory path without sanitizing directory traversal sequences. This makes it possible for unauthenticated attackers to trigger the creation of a ZIP archive containing arbitrary files from the server&#39;s filesystem — including wp-config.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-6403 https://cve.radiocsirt.org/vuln/ghsa-5vxp-83xg-5c9f <p>The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply_zip_theme() function, which appends a user-controlled &#39;stylesheet&#39; parameter directly to the theme root directory path without sanitizing directory traversal sequences. This makes it possible for unauthenticated attackers to trigger the creation of a ZIP archive containing arbitrary files from the server&#39;s filesystem — including wp-config.</p> <p>The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply_zip_theme() function, which appends a user-controlled &#39;stylesheet&#39; parameter directly to the theme root directory path without sanitizing directory traversal sequences. This makes it possible for unauthenticated attackers to trigger the creation of a ZIP archive containing arbitrary files from the server&#39;s filesystem — including wp-config.</p> https://cve.radiocsirt.org/vuln/ghsa-5vxp-83xg-5c9f