https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 18:47:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329870 EUVD-2026-329870 https://cve.radiocsirt.org/vuln/euvd-2026-329870 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9184 <p>The 24liveblog - live blog tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_lb24_token() AJAX function in versions up to, and including, 2.2. The handler only verifies the &#39;lb24&#39; nonce (which is generated and localized to any user with block editor access via lb24_block_enqueue_scripts()) and does not verify the user&#39;s capabilities or that the supplied user_id belongs to the current user. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname user meta values of any user (including administrators) as well as the corresponding site-wide options, effectively hijacking the plugin&#39;s integration with the 24liveblog service.</p> <p>The 24liveblog - live blog tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_lb24_token() AJAX function in versions up to, and including, 2.2. The handler only verifies the &#39;lb24&#39; nonce (which is generated and localized to any user with block editor access via lb24_block_enqueue_scripts()) and does not verify the user&#39;s capabilities or that the supplied user_id belongs to the current user. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname user meta values of any user (including administrators) as well as the corresponding site-wide options, effectively hijacking the plugin&#39;s integration with the 24liveblog service.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9184 https://cve.radiocsirt.org/vuln/ghsa-hwxf-h8x7-c976 <p>The 24liveblog - live blog tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_lb24_token() AJAX function in versions up to, and including, 2.2. The handler only verifies the &#39;lb24&#39; nonce (which is generated and localized to any user with block editor access via lb24_block_enqueue_scripts()) and does not verify the user&#39;s capabilities or that the supplied user_id belongs to the current user. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname user meta values of any user (including administrators) as well as the corresponding site-wide options, effectively hijacking the plugin&#39;s integration with the 24liveblog service.</p> <p>The 24liveblog - live blog tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_lb24_token() AJAX function in versions up to, and including, 2.2. The handler only verifies the &#39;lb24&#39; nonce (which is generated and localized to any user with block editor access via lb24_block_enqueue_scripts()) and does not verify the user&#39;s capabilities or that the supplied user_id belongs to the current user. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname user meta values of any user (including administrators) as well as the corresponding site-wide options, effectively hijacking the plugin&#39;s integration with the 24liveblog service.</p> https://cve.radiocsirt.org/vuln/ghsa-hwxf-h8x7-c976