Search
Find a vulnerability
Search criteria
248 vulnerabilities by automattic
CVE-2026-106602 (GCVE-0-2026-106602)
Vulnerability from nvd – Published: 2026-10-09 12:08 – Updated: 2026-10-09 12:08 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
Severity
4.8 (Medium)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | Jetpack |
Affected:
0 , ≤ 16.2
(custom)
|
Date Public
2026-10-07 11:21
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "jetpack",
"product": "Jetpack",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "16.3",
"status": "unaffected"
}
],
"lessThanOrEqual": "16.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ananda Dhakal (Patchstack)"
}
],
"datePublic": "2026-10-07T11:21:22.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.\u003cp\u003eThis issue affects Jetpack: from n/a through 16.2.\u003c/p\u003e"
}
],
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2."
}
],
"impacts": [
{
"capecId": "CAPEC-50",
"descriptions": [
{
"lang": "en",
"value": "Password Recovery Exploitation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T12:08:38.768Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/jetpack/vulnerability/wordpress-jetpack-plugin-16-2-broken-authentication-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Jetpack plugin to the latest available version (at least 16.3)."
}
],
"value": "Update the WordPress Jetpack plugin to the latest available version (at least 16.3)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Jetpack plugin \u003c= 16.2 - Broken Authentication vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-106602",
"datePublished": "2026-10-09T12:08:38.768Z",
"dateReserved": "2026-10-07T00:21:31.996Z",
"dateUpdated": "2026-10-09T12:08:38.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106601 (GCVE-0-2026-106601)
Vulnerability from nvd – Published: 2026-10-09 12:08 – Updated: 2026-10-09 15:09 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 14:54 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | Jetpack |
Affected:
0 , ≤ 16.2
(custom)
|
Date Public
2026-10-07 11:22
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T14:54:34.946553Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T15:09:49.660Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "jetpack",
"product": "Jetpack",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "16.3",
"status": "unaffected"
}
],
"lessThanOrEqual": "16.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ananda Dhakal (Patchstack)"
}
],
"datePublic": "2026-10-07T11:22:47.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.\u003cp\u003eThis issue affects Jetpack: from n/a through 16.2.\u003c/p\u003e"
}
],
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2."
}
],
"impacts": [
{
"capecId": "CAPEC-50",
"descriptions": [
{
"lang": "en",
"value": "Password Recovery Exploitation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T12:08:38.787Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/jetpack/vulnerability/wordpress-jetpack-plugin-16-2-broken-authentication-vulnerability-2?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Jetpack plugin to the latest available version (at least 16.3)."
}
],
"value": "Update the WordPress Jetpack plugin to the latest available version (at least 16.3)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Jetpack plugin \u003c= 16.2 - Broken Authentication vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-106601",
"datePublished": "2026-10-09T12:08:38.787Z",
"dateReserved": "2026-10-07T00:21:31.996Z",
"dateUpdated": "2026-10-09T15:09:49.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66666 (GCVE-0-2026-66666)
Vulnerability from nvd – Published: 2026-10-06 17:48 – Updated: 2026-10-06 20:05 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability
Summary
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.
This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 18:21 UTC
CWE
- CWE-201 - Insertion of Sensitive Information Into Sent Data
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/wordpre… | vdb-entry |
| https://wordpress.org/news/2026/10/wordpress-7-1-… | release-notes |
| https://patchstack.com/articles/wordpress-7-1-3-s… | related |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WordPress |
Affected:
7.1 , ≤ 7.1.2
(custom)
Affected: 7.0 , ≤ 7.0.6 (custom) Affected: 6.9 , ≤ 6.9.9 (custom) Affected: 6.8 , ≤ 6.8.10 (custom) Affected: 6.7 , ≤ 6.7.9 (custom) Affected: 6.6 , ≤ 6.6.9 (custom) cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:* cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:* cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:* cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:* cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:* cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:* |
Date Public
2026-10-06 17:38
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66666",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T18:21:14.868038Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:21:39.557Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "7.1.3",
"status": "unaffected"
}
],
"lessThanOrEqual": "7.1.2",
"status": "affected",
"version": "7.1",
"versionType": "custom"
},
{
"changes": [
{
"at": "7.0.7",
"status": "unaffected"
}
],
"lessThanOrEqual": "7.0.6",
"status": "affected",
"version": "7.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.9.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.9.9",
"status": "affected",
"version": "6.9",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.8.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.8.10",
"status": "affected",
"version": "6.8",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.7.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.7.9",
"status": "affected",
"version": "6.7",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.6.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.6.9",
"status": "affected",
"version": "6.6",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:*",
"versionEndIncluding": "7.1.2",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:*",
"versionEndIncluding": "7.0.6",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.9.9",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.8.10",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.7.9",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.6.9",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ananda Dhakal | Patchstack"
}
],
"datePublic": "2026-10-06T17:38:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.\u003cp\u003eThis issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.\u003c/p\u003e"
}
],
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.\n\nThis issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:05:54.337Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes"
],
"url": "https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/"
},
{
"tags": [
"related"
],
"url": "https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WordPress wordpress to the latest available version (at least 7.1.3, 7.0.7, 6.9.10, 6.8.11, 6.7.10, 6.6.10)."
}
],
"value": "Update the WordPress WordPress wordpress to the latest available version (at least 7.1.3, 7.0.7, 6.9.10, 6.8.11, 6.7.10, 6.6.10)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress Core \u003c= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-66666",
"datePublished": "2026-10-06T17:48:37.371Z",
"dateReserved": "2026-07-27T14:00:48.793Z",
"dateUpdated": "2026-10-06T20:05:54.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93485 (GCVE-0-2026-93485)
Vulnerability from nvd – Published: 2026-09-18 06:00 – Updated: 2026-09-19 14:21 X_Open Source
VLAI
EPSS
VEX
Title
WordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS.
This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.
The Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:21 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/wordpre… | vdb-entry |
| https://wordpress.org/news/2026/09/wordpress-7-1-… | release-notes |
Impacted products
25 products
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WordPress |
Affected:
7.1 , < 7.1.1
(custom)
|
|
| Automattic | WordPress |
Affected:
7.0 , ≤ 7.0.4
(custom)
|
|
| Automattic | WordPress |
Affected:
6.9 , ≤ 6.9.7
(custom)
|
|
| Automattic | WordPress |
Affected:
6.8 , ≤ 6.8.8
(custom)
|
|
| Automattic | WordPress |
Affected:
6.7 , ≤ 6.7.7
(custom)
|
|
| Automattic | WordPress |
Affected:
6.6 , ≤ 6.6.7
(custom)
|
|
| Automattic | WordPress |
Affected:
6.5 , ≤ 6.5.10
(custom)
|
|
| Automattic | WordPress |
Affected:
6.4 , ≤ 6.4.10
(custom)
|
|
| Automattic | WordPress |
Affected:
6.3 , ≤ 6.3.10
(custom)
|
|
| Automattic | WordPress |
Affected:
6.2 , ≤ 6.2.11
(custom)
|
|
| Automattic | WordPress |
Affected:
6.1 , ≤ 6.1.12
(custom)
|
|
| Automattic | WordPress |
Affected:
6.0 , ≤ 6.0.14
(custom)
|
|
| Automattic | WordPress |
Affected:
5.9 , ≤ 5.9.16
(custom)
|
|
| Automattic | WordPress |
Affected:
5.8 , ≤ 5.8.15
(custom)
|
|
| Automattic | WordPress |
Affected:
5.7 , ≤ 5.7.17
(custom)
|
|
| Automattic | WordPress |
Affected:
5.6 , ≤ 5.6.19
(custom)
|
|
| Automattic | WordPress |
Affected:
5.5 , ≤ 5.5.20
(custom)
|
|
| Automattic | WordPress |
Affected:
5.4 , ≤ 5.4.21
(custom)
|
|
| Automattic | WordPress |
Affected:
5.3 , ≤ 5.3.23
(custom)
|
|
| Automattic | WordPress |
Affected:
5.2 , ≤ 5.2.26
(custom)
|
|
| Automattic | WordPress |
Affected:
5.1 , ≤ 5.1.24
(custom)
|
|
| Automattic | WordPress |
Affected:
5.0 , ≤ 5.0.27
(custom)
|
|
| Automattic | WordPress |
Affected:
4.9 , ≤ 4.9.31
(custom)
|
|
| Automattic | WordPress |
Affected:
4.8 , ≤ 4.8.30
(custom)
|
|
| Automattic | WordPress |
Affected:
4.7 , ≤ 4.7.35
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93485",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:21:30.559066Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:21:52.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "7.1.1",
"status": "unaffected"
}
],
"lessThan": "7.1.1",
"status": "affected",
"version": "7.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "7.0.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.9.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.9.7",
"status": "affected",
"version": "6.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.8.9",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.8.8",
"status": "affected",
"version": "6.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.7.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.7.7",
"status": "affected",
"version": "6.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.6.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.6.7",
"status": "affected",
"version": "6.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.5.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.5.10",
"status": "affected",
"version": "6.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.4.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.4.10",
"status": "affected",
"version": "6.4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.3.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.3.10",
"status": "affected",
"version": "6.3",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.2.12",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.2.11",
"status": "affected",
"version": "6.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.1.13",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.1.12",
"status": "affected",
"version": "6.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.0.14",
"status": "affected",
"version": "6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.9.17",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.9.16",
"status": "affected",
"version": "5.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.8.16",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.8.15",
"status": "affected",
"version": "5.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.7.18",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.7.17",
"status": "affected",
"version": "5.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.6.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.6.19",
"status": "affected",
"version": "5.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.5.21",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.5.20",
"status": "affected",
"version": "5.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.4.22",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.4.21",
"status": "affected",
"version": "5.4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.3.24",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.3.23",
"status": "affected",
"version": "5.3",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.2.27",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.2.26",
"status": "affected",
"version": "5.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.1.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.1.24",
"status": "affected",
"version": "5.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.0.28",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.27",
"status": "affected",
"version": "5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "4.9.32",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.9.31",
"status": "affected",
"version": "4.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "4.8.31",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.8.30",
"status": "affected",
"version": "4.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "4.7.36",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.7.35",
"status": "affected",
"version": "4.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Rafie Muhammad | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Automattic WordPress core allows DOM-Based XSS.\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eThis issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003cp\u003e\u003cspan\u003eThe Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Automattic WordPress core allows DOM-Based XSS.\n\n\nThis issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.\n\n\n\n\nThe Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed."
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 DOM-Based XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T06:00:05.645Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes"
],
"url": "https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress to the latest available version of it\u0027s version range:\u0026nbsp;\u003cspan\u003e7.1.1, 7.0.5, 6.9.8, 6.8.9, 6.7.8, 6.6.8, 6.5.11, 6.4.11, 6.3.11, 6.2.12, 6.1.13, 6.0.15, 5.9.17, 5.8.16, 5.7.18, 5.6.20, 5.5.21, 5.4.22, 5.3.24, 5.2.27, 5.1.25, 5.0.28, 4.9.32, 4.8.31, 4.7.36\u003c/span\u003e"
}
],
"value": "Update the WordPress to the latest available version of it\u0027s version range:\u00a07.1.1, 7.0.5, 6.9.8, 6.8.9, 6.7.8, 6.6.8, 6.5.11, 6.4.11, 6.3.11, 6.2.12, 6.1.13, 6.0.15, 5.9.17, 5.8.16, 5.7.18, 5.6.20, 5.5.21, 5.4.22, 5.3.24, 5.2.27, 5.1.25, 5.0.28, 4.9.32, 4.8.31, 4.7.36"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress core \u003c= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-93485",
"datePublished": "2026-09-18T06:00:05.645Z",
"dateReserved": "2026-09-18T05:11:39.339Z",
"dateUpdated": "2026-09-19T14:21:52.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48888 (GCVE-0-2026-48888)
Vulnerability from nvd – Published: 2026-09-08 07:25 – Updated: 2026-09-08 10:34 X_Open Source
VLAI
EPSS
VEX
Title
WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability
Summary
Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS.
This issue affects WooCommerce: from n/a before 11.1.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 09:51 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WooCommerce |
Affected:
n/a , < 11.1.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48888",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T09:51:03.722557Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T10:34:56.442Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "woocommerce",
"product": "WooCommerce",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "11.1.0",
"status": "unaffected"
}
],
"lessThan": "11.1.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal | Patchstack"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS.\u003cp\u003eThis issue affects WooCommerce: from n/a before 11.1.0.\u003c/p\u003e"
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS.\n\nThis issue affects WooCommerce: from n/a before 11.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-469",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-469 HTTP DoS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T07:25:20.910Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-11-1-0-denial-of-service-attack-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WooCommerce Plugin to the latest available version (at least 11.1.0)."
}
],
"value": "Update the WordPress WooCommerce Plugin to the latest available version (at least 11.1.0)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress WooCommerce plugin \u003c 11.1.0 - Denial of Service Attack vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-48888",
"datePublished": "2026-09-08T07:25:20.910Z",
"dateReserved": "2026-05-25T22:37:16.413Z",
"dateUpdated": "2026-09-08T10:34:56.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57777 (GCVE-0-2026-57777)
Vulnerability from nvd – Published: 2026-09-04 08:12 – Updated: 2026-09-04 16:36 X_Open Source
VLAI
EPSS
VEX
Title
WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection.
This issue affects WooCommerce: from n/a before 11.0.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 16:36 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
| https://github.com/woocommerce/woocommerce/pull/67554 | issue-trackingpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WooCommerce |
Affected:
n/a , < 11.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57777",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T16:36:31.465841Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T16:36:55.172Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "woocommerce",
"product": "WooCommerce",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "11.0",
"status": "unaffected"
}
],
"lessThan": "11.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Automattic WooCommerce allows Blind SQL Injection.\u003cp\u003eThis issue affects WooCommerce: from n/a before 11.0.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Automattic WooCommerce allows Blind SQL Injection.\n\nThis issue affects WooCommerce: from n/a before 11.0."
}
],
"impacts": [
{
"capecId": "CAPEC-7",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-7 Blind SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T08:12:00.611Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-10-9-4-sql-injection-vulnerability?_s_id=cve"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/woocommerce/woocommerce/pull/67554"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WooCommerce Plugin to the latest available version (at least 11.0)."
}
],
"value": "Update the WordPress WooCommerce Plugin to the latest available version (at least 11.0)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress WooCommerce plugin \u003c 11.0 - SQL Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-57777",
"datePublished": "2026-09-04T08:12:00.611Z",
"dateReserved": "2026-06-25T08:04:53.458Z",
"dateUpdated": "2026-09-04T16:36:55.172Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73562 (GCVE-0-2026-73562)
Vulnerability from nvd – Published: 2026-08-13 17:27 – Updated: 2026-08-14 18:09
VLAI
EPSS
VEX
Title
Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
Summary
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOne(filter, req.body) can exploit Mongoose update casting with a __proto__.x dotted path under $set. Schema.prototype.path and Schema.prototype._getPathType can treat inherited properties of schema.paths and schema.nested as schema types, allowing the casting process to set $fullPath and $parentSchemaDocArray on Object.prototype before throwing. This prototype pollution makes those properties visible on newly created objects and can cause application integrity and availability impacts. This issue is fixed in versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 17:41 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Automattic/mongoose/security/a… | x_refsource_CONFIRM |
| https://github.com/Automattic/mongoose/commit/35a… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/commit/728… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/commit/953… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/commit/fab… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | mongoose |
Affected:
< 6.13.10
Affected: >= 7.0.0, < 7.8.10 Affected: >= 8.0.0, < 8.24.1 Affected: >= 9.0.0, < 9.7.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73562",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T17:41:16.928150Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T18:09:27.112Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mongoose",
"vendor": "Automattic",
"versions": [
{
"status": "affected",
"version": "\u003c 6.13.10"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c 7.8.10"
},
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.24.1"
},
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c 9.7.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOne(filter, req.body) can exploit Mongoose update casting with a __proto__.x dotted path under $set. Schema.prototype.path and Schema.prototype._getPathType can treat inherited properties of schema.paths and schema.nested as schema types, allowing the casting process to set $fullPath and $parentSchemaDocArray on Object.prototype before throwing. This prototype pollution makes those properties visible on newly created objects and can cause application integrity and availability impacts. This issue is fixed in versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T17:27:09.914Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw"
},
{
"name": "https://github.com/Automattic/mongoose/commit/35a3f33bc9a0a28671f99e3c5010000425650d0f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/35a3f33bc9a0a28671f99e3c5010000425650d0f"
},
{
"name": "https://github.com/Automattic/mongoose/commit/7285466b860d3b511f8d07b2ab72656703ee707a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/7285466b860d3b511f8d07b2ab72656703ee707a"
},
{
"name": "https://github.com/Automattic/mongoose/commit/953d085bee5a16b5d6c5af33a156e6314d6d9a45",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/953d085bee5a16b5d6c5af33a156e6314d6d9a45"
},
{
"name": "https://github.com/Automattic/mongoose/commit/fab793b747131c68927888cba41cf3e6d6593740",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/fab793b747131c68927888cba41cf3e6d6593740"
}
],
"source": {
"advisory": "GHSA-664h-wqgq-64gw",
"discovery": "UNKNOWN"
},
"title": "Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73562",
"datePublished": "2026-08-13T17:27:09.914Z",
"dateReserved": "2026-08-12T20:53:46.380Z",
"dateUpdated": "2026-08-14T18:09:27.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42334 (GCVE-0-2026-42334)
Vulnerability from nvd – Published: 2026-05-14 18:03 – Updated: 2026-05-14 18:18
VLAI
EPSS
VEX
Title
Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
Summary
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-14 18:17 UTC
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/Automattic/mongoose/security/a… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | mongoose |
Affected:
< 6.13.9
Affected: >= 7.0.0, <= 7.8.8 Affected: >= 8.0.0, <= 8.22.0 Affected: >= 9.0.0, <= 9.1.5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42334",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-14T18:17:58.426797Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T18:18:06.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mongoose",
"vendor": "Automattic",
"versions": [
{
"status": "affected",
"version": "\u003c 6.13.9"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c= 7.8.8"
},
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c= 8.22.0"
},
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c= 9.1.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose\u2019s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T18:03:43.196Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h"
}
],
"source": {
"advisory": "GHSA-wpg9-53fq-2r8h",
"discovery": "UNKNOWN"
},
"title": "Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42334",
"datePublished": "2026-05-14T18:03:43.196Z",
"dateReserved": "2026-04-26T13:26:14.514Z",
"dateUpdated": "2026-05-14T18:18:06.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4338 (GCVE-0-2026-4338)
Vulnerability from nvd – Published: 2026-04-08 06:00 – Updated: 2026-04-08 16:06
VLAI
EPSS
VEX
Title
ActivityPub Routing < 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure
Summary
The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-08 16:06 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/50f68395-72fc-4f… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | ActivityPub |
Affected:
0 , < 8.0.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-4338",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-08T16:06:38.334257Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:06:53.365Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ActivityPub",
"vendor": "Unknown",
"versions": [
{
"lessThan": "8.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ryuk (kos0ng)"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T06:00:08.001Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/50f68395-72fc-4f99-8e6d-6aa90cc640b5/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ActivityPub Routing \u003c 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-4338",
"datePublished": "2026-04-08T06:00:08.001Z",
"dateReserved": "2026-03-17T14:54:23.077Z",
"dateUpdated": "2026-04-08T16:06:53.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3589 (GCVE-0-2026-3589)
Vulnerability from nvd – Published: 2026-03-06 09:11 – Updated: 2026-03-06 17:44
VLAI
EPSS
VEX
Title
WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF
Summary
The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-06 17:44 UTC
CWE
- CWE-352 Cross-Site Request Forgery (CSRF)
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/53ded097-274d-48… | exploitvdb-entrytechnical-description |
| https://developer.woocommerce.com/2026/03/02/stor… | technical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WooCommerce |
Affected:
5.4.0 , < 5.4.4
(semver)
Affected: 5.5.0 , < 5.4.5 (semver) Affected: 5.6.0 , < 5.6.3 (semver) Affected: 5.7.0 , < 5.7.3 (semver) Affected: 5.8.0 , < 5.8.2 (semver) Affected: 5.9.0 , < 5.9.2 (semver) Affected: 6.0.0 , < 6.0.2 (semver) Affected: 6.1.0 , < 6.1.3 (semver) Affected: 6.2.0 , < 6.2.3 (semver) Affected: 6.3.0 , < 6.3.2 (semver) Affected: 6.4.0 , < 6.4.2 (semver) Affected: 6.5.0 , < 6.5.2 (semver) Affected: 6.6.0 , < 6.6.2 (semver) Affected: 6.7.0 , < 6.7.1 (semver) Affected: 6.8.0 , < 6.8.3 (semver) Affected: 6.9.0 , < 6.9.5 (semver) Affected: 7.0.0 , < 7.0.2 (semver) Affected: 7.1.0 , < 7.1.2 (semver) Affected: 7.2.0 , < 7.2.4 (semver) Affected: 7.3.0 , < 7.3.1 (semver) Affected: 7.4.0 , < 7.4.2 (semver) Affected: 7.5.0 , < 7.5.2 (semver) Affected: 7.6.0 , < 7.6.2 (semver) Affected: 7.7.0 , < 7.7.3 (semver) Affected: 7.8.0 , < 7.8.4 (semver) Affected: 7.9.0 , < 7.9.2 (semver) Affected: 8.0.0 , < 8.0.5 (semver) Affected: 8.1.0 , < 8.1.4 (semver) Affected: 8.2.0 , < 8.2.5 (semver) Affected: 8.3.0 , < 8.3.4 (semver) Affected: 8.4.0 , < 8.4.3 (semver) Affected: 8.5.0 , < 8.5.5 (semver) Affected: 8.6.0 , < 8.6.4 (semver) Affected: 8.7.0 , < 8.7.3 (semver) Affected: 8.8.0 , < 8.8.7 (semver) Affected: 8.9.0 , < 8.9.5 (semver) Affected: 9.0.0 , < 9.0.4 (semver) Affected: 9.1.0 , < 9.1.7 (semver) Affected: 9.2.0 , < 9.2.5 (semver) Affected: 9.3.0 , < 9.3.6 (semver) Affected: 9.4.0 , < 9.4.5 (semver) Affected: 9.5.0 , < 9.5.4 (semver) Affected: 9.6.0 , < 9.6.4 (semver) Affected: 9.7.0 , < 9.7.3 (semver) Affected: 9.8.0 , < 9.8.7 (semver) Affected: 9.9.0 , < 9.9.7 (semver) Affected: 10.0.0 , < 10.0.6 (semver) Affected: 10.1.0 , < 10.1.4 (semver) Affected: 10.2.0 , < 10.2.4 (semver) Affected: 10.3.0 , < 10.3.8 (semver) Affected: 10.4.0 , < 10.4.4 (semver) Affected: 10.5.0 , < 10.5.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-3589",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-06T17:44:54.283745Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T17:44:58.613Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "WooCommerce",
"vendor": "Automattic",
"versions": [
{
"lessThan": "5.4.4",
"status": "affected",
"version": "5.4.0",
"versionType": "semver"
},
{
"lessThan": "5.4.5",
"status": "affected",
"version": "5.5.0",
"versionType": "semver"
},
{
"lessThan": "5.6.3",
"status": "affected",
"version": "5.6.0",
"versionType": "semver"
},
{
"lessThan": "5.7.3",
"status": "affected",
"version": "5.7.0",
"versionType": "semver"
},
{
"lessThan": "5.8.2",
"status": "affected",
"version": "5.8.0",
"versionType": "semver"
},
{
"lessThan": "5.9.2",
"status": "affected",
"version": "5.9.0",
"versionType": "semver"
},
{
"lessThan": "6.0.2",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThan": "6.1.3",
"status": "affected",
"version": "6.1.0",
"versionType": "semver"
},
{
"lessThan": "6.2.3",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThan": "6.3.2",
"status": "affected",
"version": "6.3.0",
"versionType": "semver"
},
{
"lessThan": "6.4.2",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"lessThan": "6.5.2",
"status": "affected",
"version": "6.5.0",
"versionType": "semver"
},
{
"lessThan": "6.6.2",
"status": "affected",
"version": "6.6.0",
"versionType": "semver"
},
{
"lessThan": "6.7.1",
"status": "affected",
"version": "6.7.0",
"versionType": "semver"
},
{
"lessThan": "6.8.3",
"status": "affected",
"version": "6.8.0",
"versionType": "semver"
},
{
"lessThan": "6.9.5",
"status": "affected",
"version": "6.9.0",
"versionType": "semver"
},
{
"lessThan": "7.0.2",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThan": "7.1.2",
"status": "affected",
"version": "7.1.0",
"versionType": "semver"
},
{
"lessThan": "7.2.4",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThan": "7.3.1",
"status": "affected",
"version": "7.3.0",
"versionType": "semver"
},
{
"lessThan": "7.4.2",
"status": "affected",
"version": "7.4.0",
"versionType": "semver"
},
{
"lessThan": "7.5.2",
"status": "affected",
"version": "7.5.0",
"versionType": "semver"
},
{
"lessThan": "7.6.2",
"status": "affected",
"version": "7.6.0",
"versionType": "semver"
},
{
"lessThan": "7.7.3",
"status": "affected",
"version": "7.7.0",
"versionType": "semver"
},
{
"lessThan": "7.8.4",
"status": "affected",
"version": "7.8.0",
"versionType": "semver"
},
{
"lessThan": "7.9.2",
"status": "affected",
"version": "7.9.0",
"versionType": "semver"
},
{
"lessThan": "8.0.5",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThan": "8.1.4",
"status": "affected",
"version": "8.1.0",
"versionType": "semver"
},
{
"lessThan": "8.2.5",
"status": "affected",
"version": "8.2.0",
"versionType": "semver"
},
{
"lessThan": "8.3.4",
"status": "affected",
"version": "8.3.0",
"versionType": "semver"
},
{
"lessThan": "8.4.3",
"status": "affected",
"version": "8.4.0",
"versionType": "semver"
},
{
"lessThan": "8.5.5",
"status": "affected",
"version": "8.5.0",
"versionType": "semver"
},
{
"lessThan": "8.6.4",
"status": "affected",
"version": "8.6.0",
"versionType": "semver"
},
{
"lessThan": "8.7.3",
"status": "affected",
"version": "8.7.0",
"versionType": "semver"
},
{
"lessThan": "8.8.7",
"status": "affected",
"version": "8.8.0",
"versionType": "semver"
},
{
"lessThan": "8.9.5",
"status": "affected",
"version": "8.9.0",
"versionType": "semver"
},
{
"lessThan": "9.0.4",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"lessThan": "9.1.7",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
},
{
"lessThan": "9.2.5",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
},
{
"lessThan": "9.3.6",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
},
{
"lessThan": "9.4.5",
"status": "affected",
"version": "9.4.0",
"versionType": "semver"
},
{
"lessThan": "9.5.4",
"status": "affected",
"version": "9.5.0",
"versionType": "semver"
},
{
"lessThan": "9.6.4",
"status": "affected",
"version": "9.6.0",
"versionType": "semver"
},
{
"lessThan": "9.7.3",
"status": "affected",
"version": "9.7.0",
"versionType": "semver"
},
{
"lessThan": "9.8.7",
"status": "affected",
"version": "9.8.0",
"versionType": "semver"
},
{
"lessThan": "9.9.7",
"status": "affected",
"version": "9.9.0",
"versionType": "semver"
},
{
"lessThan": "10.0.6",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
},
{
"lessThan": "10.1.4",
"status": "affected",
"version": "10.1.0",
"versionType": "semver"
},
{
"lessThan": "10.2.4",
"status": "affected",
"version": "10.2.0",
"versionType": "semver"
},
{
"lessThan": "10.3.8",
"status": "affected",
"version": "10.3.0",
"versionType": "semver"
},
{
"lessThan": "10.4.4",
"status": "affected",
"version": "10.4.0",
"versionType": "semver"
},
{
"lessThan": "10.5.3",
"status": "affected",
"version": "10.5.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "oolongeya"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T09:11:10.949Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553/"
},
{
"tags": [
"technical-description"
],
"url": "https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WooCommerce \u003c 10.5.3 - Arbitrary Admin User Creation via CSRF",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-3589",
"datePublished": "2026-03-06T09:11:10.949Z",
"dateReserved": "2026-03-05T10:41:21.729Z",
"dateUpdated": "2026-03-06T17:44:58.613Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22356 (GCVE-0-2026-22356)
Vulnerability from nvd – Published: 2026-02-20 15:47 – Updated: 2026-04-28 16:48
VLAI
EPSS
VEX
Title
WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability
Summary
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Automattic Jetpack CRM zero-bs-crm allows PHP Local File Inclusion.This issue affects Jetpack CRM: from n/a through <= 6.7.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-24 20:06 UTC
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | Jetpack CRM |
Affected:
0 , ≤ 6.7.0
(custom)
|
Date Public
2026-04-01 16:03
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22356",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T20:06:14.780720Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:48:37.720Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "zero-bs-crm",
"product": "Jetpack CRM",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.7.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.7.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Skalucy | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-01T16:03:55.962Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027) vulnerability in Automattic Jetpack CRM zero-bs-crm allows PHP Local File Inclusion.\u003cp\u003eThis issue affects Jetpack CRM: from n/a through \u003c= 6.7.0.\u003c/p\u003e"
}
],
"value": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027) vulnerability in Automattic Jetpack CRM zero-bs-crm allows PHP Local File Inclusion.This issue affects Jetpack CRM: from n/a through \u003c= 6.7.0."
}
],
"impacts": [
{
"capecId": "CAPEC-252",
"descriptions": [
{
"lang": "en",
"value": "PHP Local File Inclusion"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:14:41.261Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/zero-bs-crm/vulnerability/wordpress-jetpack-crm-plugin-6-7-0-local-file-inclusion-vulnerability?_s_id=cve"
}
],
"title": "WordPress Jetpack CRM plugin \u003c= 6.7.0 - Local File Inclusion vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-22356",
"datePublished": "2026-02-20T15:47:01.362Z",
"dateReserved": "2026-01-07T12:21:24.564Z",
"dateUpdated": "2026-04-28T16:48:37.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25404 (GCVE-0-2026-25404)
Vulnerability from nvd – Published: 2026-02-19 08:27 – Updated: 2026-04-28 16:14
VLAI
EPSS
VEX
Title
WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager: from n/a through <= 2.4.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-24 21:14 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WP Job Manager |
Affected:
0 , ≤ 2.4.0
(custom)
|
Date Public
2026-04-01 16:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T21:14:57.107690Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T13:14:50.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-job-manager",
"product": "WP Job Manager",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "2.4.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Jay Neale | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-01T16:05:08.121Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects WP Job Manager: from n/a through \u003c= 2.4.0.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager: from n/a through \u003c= 2.4.0."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:14:58.267Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/wp-job-manager/vulnerability/wordpress-wp-job-manager-plugin-2-4-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"title": "WordPress WP Job Manager plugin \u003c= 2.4.0 - Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-25404",
"datePublished": "2026-02-19T08:27:04.284Z",
"dateReserved": "2026-02-02T12:53:19.000Z",
"dateUpdated": "2026-04-28T16:14:58.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-54332 (GCVE-0-2023-54332)
Vulnerability from nvd – Published: 2026-01-13 22:56 – Updated: 2026-05-24 01:37
VLAI
EPSS
VEX
Title
Jetpack 11.4 - Cross Site Scripting (XSS)
Summary
Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 15:02 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/51104 | exploit |
| https://wordpress.org/plugins/jetpack | product |
| https://www.vulncheck.com/advisories/jetpack-cros… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | Jetpack |
Affected:
11.4
cpe:2.3:a:automattic:jetpack_boost:11.4:*:*:*:*:*:*:* |
Date Public
2022-10-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-54332",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T15:02:29.264946Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T15:02:35.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jetpack",
"vendor": "Automattic",
"versions": [
{
"status": "affected",
"version": "11.4"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:automattic:jetpack_boost:11.4:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Behrouz Mansoori"
}
],
"datePublic": "2022-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims\u0027 browsers when they interact with the contact form page."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-24T01:37:37.697Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "ExploitDB-51104",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/51104"
},
{
"name": "Jetpack WordPress Plugin Homepage",
"tags": [
"product"
],
"url": "https://wordpress.org/plugins/jetpack"
},
{
"name": "VulnCheck Advisory: Jetpack 11.4 - Cross Site Scripting (XSS)",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jetpack-cross-site-scripting-xss"
}
],
"title": "Jetpack 11.4 - Cross Site Scripting (XSS)",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-54332",
"datePublished": "2026-01-13T22:56:39.597Z",
"dateReserved": "2026-01-10T01:51:52.983Z",
"dateUpdated": "2026-05-24T01:37:37.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-52212 (GCVE-0-2023-52212)
Vulnerability from nvd – Published: 2026-01-05 13:32 – Updated: 2026-04-28 16:09 X_Open Source
VLAI
EPSS
VEX
Title
WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability
Summary
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-05 21:17 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://vdp.patchstack.com/database/wordpress/plu… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WP Job Manager |
Affected:
n/a , ≤ 2.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-52212",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-05T21:17:41.837689Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T21:17:55.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-job-manager",
"product": "WP Job Manager",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "2.1.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "2.0.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Rafie Muhammad | Patchstack Threat Intelligence"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.\u003cp\u003eThis issue affects WP Job Manager: from n/a through 2.0.0.\u003c/p\u003e"
}
],
"value": "Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-62 Cross Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:09:06.920Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://vdp.patchstack.com/database/wordpress/plugin/wp-job-manager/vulnerability/wordpress-wp-job-manager-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WP Job Manager plugin to the latest available version (at least 2.1.0)."
}
],
"value": "Update the WordPress WP Job Manager plugin to the latest available version (at least 2.1.0)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress WP Job Manager plugin \u003c= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2023-52212",
"datePublished": "2026-01-05T13:32:30.854Z",
"dateReserved": "2023-12-29T12:26:03.425Z",
"dateUpdated": "2026-04-28T16:09:06.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-69015 (GCVE-0-2025-69015)
Vulnerability from nvd – Published: 2025-12-30 10:47 – Updated: 2026-04-28 16:14
VLAI
EPSS
VEX
Title
WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-30 14:32 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | Crowdsignal Forms |
Affected:
0 , ≤ 1.7.2
(custom)
|
Date Public
2026-04-22 14:23
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-69015",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-30T14:32:01.594432Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-27T19:44:40.305Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "crowdsignal-forms",
"product": "Crowdsignal Forms",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "1.8.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Doan Dinh Van | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-22T14:23:01.051Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Crowdsignal Forms: from n/a through \u003c= 1.7.2.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through \u003c= 1.7.2."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.8,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:14:34.426Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/crowdsignal-forms/vulnerability/wordpress-crowdsignal-forms-plugin-1-7-2-broken-access-control-vulnerability?_s_id=cve"
}
],
"title": "WordPress Crowdsignal Forms plugin \u003c= 1.7.2 - Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2025-69015",
"datePublished": "2025-12-30T10:47:53.892Z",
"dateReserved": "2025-12-29T11:18:30.572Z",
"dateUpdated": "2026-04-28T16:14:34.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106601 (GCVE-0-2026-106601)
Vulnerability from cvelistv5 – Published: 2026-10-09 12:08 – Updated: 2026-10-09 15:09 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 14:54 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | Jetpack |
Affected:
0 , ≤ 16.2
(custom)
|
Date Public
2026-10-07 11:22
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T14:54:34.946553Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T15:09:49.660Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "jetpack",
"product": "Jetpack",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "16.3",
"status": "unaffected"
}
],
"lessThanOrEqual": "16.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ananda Dhakal (Patchstack)"
}
],
"datePublic": "2026-10-07T11:22:47.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.\u003cp\u003eThis issue affects Jetpack: from n/a through 16.2.\u003c/p\u003e"
}
],
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2."
}
],
"impacts": [
{
"capecId": "CAPEC-50",
"descriptions": [
{
"lang": "en",
"value": "Password Recovery Exploitation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T12:08:38.787Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/jetpack/vulnerability/wordpress-jetpack-plugin-16-2-broken-authentication-vulnerability-2?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Jetpack plugin to the latest available version (at least 16.3)."
}
],
"value": "Update the WordPress Jetpack plugin to the latest available version (at least 16.3)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Jetpack plugin \u003c= 16.2 - Broken Authentication vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-106601",
"datePublished": "2026-10-09T12:08:38.787Z",
"dateReserved": "2026-10-07T00:21:31.996Z",
"dateUpdated": "2026-10-09T15:09:49.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106602 (GCVE-0-2026-106602)
Vulnerability from cvelistv5 – Published: 2026-10-09 12:08 – Updated: 2026-10-09 12:08 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
Severity
4.8 (Medium)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | Jetpack |
Affected:
0 , ≤ 16.2
(custom)
|
Date Public
2026-10-07 11:21
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "jetpack",
"product": "Jetpack",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "16.3",
"status": "unaffected"
}
],
"lessThanOrEqual": "16.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ananda Dhakal (Patchstack)"
}
],
"datePublic": "2026-10-07T11:21:22.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.\u003cp\u003eThis issue affects Jetpack: from n/a through 16.2.\u003c/p\u003e"
}
],
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2."
}
],
"impacts": [
{
"capecId": "CAPEC-50",
"descriptions": [
{
"lang": "en",
"value": "Password Recovery Exploitation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T12:08:38.768Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/jetpack/vulnerability/wordpress-jetpack-plugin-16-2-broken-authentication-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Jetpack plugin to the latest available version (at least 16.3)."
}
],
"value": "Update the WordPress Jetpack plugin to the latest available version (at least 16.3)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Jetpack plugin \u003c= 16.2 - Broken Authentication vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-106602",
"datePublished": "2026-10-09T12:08:38.768Z",
"dateReserved": "2026-10-07T00:21:31.996Z",
"dateUpdated": "2026-10-09T12:08:38.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66666 (GCVE-0-2026-66666)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:48 – Updated: 2026-10-06 20:05 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability
Summary
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.
This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 18:21 UTC
CWE
- CWE-201 - Insertion of Sensitive Information Into Sent Data
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/wordpre… | vdb-entry |
| https://wordpress.org/news/2026/10/wordpress-7-1-… | release-notes |
| https://patchstack.com/articles/wordpress-7-1-3-s… | related |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WordPress |
Affected:
7.1 , ≤ 7.1.2
(custom)
Affected: 7.0 , ≤ 7.0.6 (custom) Affected: 6.9 , ≤ 6.9.9 (custom) Affected: 6.8 , ≤ 6.8.10 (custom) Affected: 6.7 , ≤ 6.7.9 (custom) Affected: 6.6 , ≤ 6.6.9 (custom) cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:* cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:* cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:* cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:* cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:* cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:* |
Date Public
2026-10-06 17:38
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66666",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T18:21:14.868038Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:21:39.557Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "7.1.3",
"status": "unaffected"
}
],
"lessThanOrEqual": "7.1.2",
"status": "affected",
"version": "7.1",
"versionType": "custom"
},
{
"changes": [
{
"at": "7.0.7",
"status": "unaffected"
}
],
"lessThanOrEqual": "7.0.6",
"status": "affected",
"version": "7.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.9.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.9.9",
"status": "affected",
"version": "6.9",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.8.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.8.10",
"status": "affected",
"version": "6.8",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.7.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.7.9",
"status": "affected",
"version": "6.7",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.6.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.6.9",
"status": "affected",
"version": "6.6",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:*",
"versionEndIncluding": "7.1.2",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:*",
"versionEndIncluding": "7.0.6",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.9.9",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.8.10",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.7.9",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:automattic:wordpress:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.6.9",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ananda Dhakal | Patchstack"
}
],
"datePublic": "2026-10-06T17:38:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.\u003cp\u003eThis issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.\u003c/p\u003e"
}
],
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.\n\nThis issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:05:54.337Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes"
],
"url": "https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/"
},
{
"tags": [
"related"
],
"url": "https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WordPress wordpress to the latest available version (at least 7.1.3, 7.0.7, 6.9.10, 6.8.11, 6.7.10, 6.6.10)."
}
],
"value": "Update the WordPress WordPress wordpress to the latest available version (at least 7.1.3, 7.0.7, 6.9.10, 6.8.11, 6.7.10, 6.6.10)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress Core \u003c= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-66666",
"datePublished": "2026-10-06T17:48:37.371Z",
"dateReserved": "2026-07-27T14:00:48.793Z",
"dateUpdated": "2026-10-06T20:05:54.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93485 (GCVE-0-2026-93485)
Vulnerability from cvelistv5 – Published: 2026-09-18 06:00 – Updated: 2026-09-19 14:21 X_Open Source
VLAI
EPSS
VEX
Title
WordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS.
This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.
The Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:21 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/wordpre… | vdb-entry |
| https://wordpress.org/news/2026/09/wordpress-7-1-… | release-notes |
Impacted products
25 products
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WordPress |
Affected:
7.1 , < 7.1.1
(custom)
|
|
| Automattic | WordPress |
Affected:
7.0 , ≤ 7.0.4
(custom)
|
|
| Automattic | WordPress |
Affected:
6.9 , ≤ 6.9.7
(custom)
|
|
| Automattic | WordPress |
Affected:
6.8 , ≤ 6.8.8
(custom)
|
|
| Automattic | WordPress |
Affected:
6.7 , ≤ 6.7.7
(custom)
|
|
| Automattic | WordPress |
Affected:
6.6 , ≤ 6.6.7
(custom)
|
|
| Automattic | WordPress |
Affected:
6.5 , ≤ 6.5.10
(custom)
|
|
| Automattic | WordPress |
Affected:
6.4 , ≤ 6.4.10
(custom)
|
|
| Automattic | WordPress |
Affected:
6.3 , ≤ 6.3.10
(custom)
|
|
| Automattic | WordPress |
Affected:
6.2 , ≤ 6.2.11
(custom)
|
|
| Automattic | WordPress |
Affected:
6.1 , ≤ 6.1.12
(custom)
|
|
| Automattic | WordPress |
Affected:
6.0 , ≤ 6.0.14
(custom)
|
|
| Automattic | WordPress |
Affected:
5.9 , ≤ 5.9.16
(custom)
|
|
| Automattic | WordPress |
Affected:
5.8 , ≤ 5.8.15
(custom)
|
|
| Automattic | WordPress |
Affected:
5.7 , ≤ 5.7.17
(custom)
|
|
| Automattic | WordPress |
Affected:
5.6 , ≤ 5.6.19
(custom)
|
|
| Automattic | WordPress |
Affected:
5.5 , ≤ 5.5.20
(custom)
|
|
| Automattic | WordPress |
Affected:
5.4 , ≤ 5.4.21
(custom)
|
|
| Automattic | WordPress |
Affected:
5.3 , ≤ 5.3.23
(custom)
|
|
| Automattic | WordPress |
Affected:
5.2 , ≤ 5.2.26
(custom)
|
|
| Automattic | WordPress |
Affected:
5.1 , ≤ 5.1.24
(custom)
|
|
| Automattic | WordPress |
Affected:
5.0 , ≤ 5.0.27
(custom)
|
|
| Automattic | WordPress |
Affected:
4.9 , ≤ 4.9.31
(custom)
|
|
| Automattic | WordPress |
Affected:
4.8 , ≤ 4.8.30
(custom)
|
|
| Automattic | WordPress |
Affected:
4.7 , ≤ 4.7.35
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93485",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:21:30.559066Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T14:21:52.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "7.1.1",
"status": "unaffected"
}
],
"lessThan": "7.1.1",
"status": "affected",
"version": "7.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "7.0.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.9.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.9.7",
"status": "affected",
"version": "6.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.8.9",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.8.8",
"status": "affected",
"version": "6.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.7.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.7.7",
"status": "affected",
"version": "6.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.6.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.6.7",
"status": "affected",
"version": "6.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.5.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.5.10",
"status": "affected",
"version": "6.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.4.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.4.10",
"status": "affected",
"version": "6.4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.3.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.3.10",
"status": "affected",
"version": "6.3",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.2.12",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.2.11",
"status": "affected",
"version": "6.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.1.13",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.1.12",
"status": "affected",
"version": "6.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.0.14",
"status": "affected",
"version": "6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.9.17",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.9.16",
"status": "affected",
"version": "5.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.8.16",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.8.15",
"status": "affected",
"version": "5.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.7.18",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.7.17",
"status": "affected",
"version": "5.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.6.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.6.19",
"status": "affected",
"version": "5.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.5.21",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.5.20",
"status": "affected",
"version": "5.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.4.22",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.4.21",
"status": "affected",
"version": "5.4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.3.24",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.3.23",
"status": "affected",
"version": "5.3",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.2.27",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.2.26",
"status": "affected",
"version": "5.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.1.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.1.24",
"status": "affected",
"version": "5.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "5.0.28",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.27",
"status": "affected",
"version": "5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "4.9.32",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.9.31",
"status": "affected",
"version": "4.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "4.8.31",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.8.30",
"status": "affected",
"version": "4.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "4.7.36",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.7.35",
"status": "affected",
"version": "4.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Rafie Muhammad | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Automattic WordPress core allows DOM-Based XSS.\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eThis issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003cp\u003e\u003cspan\u003eThe Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Automattic WordPress core allows DOM-Based XSS.\n\n\nThis issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35.\n\n\n\n\nThe Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed."
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 DOM-Based XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T06:00:05.645Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve"
},
{
"tags": [
"release-notes"
],
"url": "https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress to the latest available version of it\u0027s version range:\u0026nbsp;\u003cspan\u003e7.1.1, 7.0.5, 6.9.8, 6.8.9, 6.7.8, 6.6.8, 6.5.11, 6.4.11, 6.3.11, 6.2.12, 6.1.13, 6.0.15, 5.9.17, 5.8.16, 5.7.18, 5.6.20, 5.5.21, 5.4.22, 5.3.24, 5.2.27, 5.1.25, 5.0.28, 4.9.32, 4.8.31, 4.7.36\u003c/span\u003e"
}
],
"value": "Update the WordPress to the latest available version of it\u0027s version range:\u00a07.1.1, 7.0.5, 6.9.8, 6.8.9, 6.7.8, 6.6.8, 6.5.11, 6.4.11, 6.3.11, 6.2.12, 6.1.13, 6.0.15, 5.9.17, 5.8.16, 5.7.18, 5.6.20, 5.5.21, 5.4.22, 5.3.24, 5.2.27, 5.1.25, 5.0.28, 4.9.32, 4.8.31, 4.7.36"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress core \u003c= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-93485",
"datePublished": "2026-09-18T06:00:05.645Z",
"dateReserved": "2026-09-18T05:11:39.339Z",
"dateUpdated": "2026-09-19T14:21:52.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48888 (GCVE-0-2026-48888)
Vulnerability from cvelistv5 – Published: 2026-09-08 07:25 – Updated: 2026-09-08 10:34 X_Open Source
VLAI
EPSS
VEX
Title
WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability
Summary
Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS.
This issue affects WooCommerce: from n/a before 11.1.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 09:51 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WooCommerce |
Affected:
n/a , < 11.1.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48888",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T09:51:03.722557Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T10:34:56.442Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "woocommerce",
"product": "WooCommerce",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "11.1.0",
"status": "unaffected"
}
],
"lessThan": "11.1.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal | Patchstack"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS.\u003cp\u003eThis issue affects WooCommerce: from n/a before 11.1.0.\u003c/p\u003e"
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS.\n\nThis issue affects WooCommerce: from n/a before 11.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-469",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-469 HTTP DoS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T07:25:20.910Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-11-1-0-denial-of-service-attack-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WooCommerce Plugin to the latest available version (at least 11.1.0)."
}
],
"value": "Update the WordPress WooCommerce Plugin to the latest available version (at least 11.1.0)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress WooCommerce plugin \u003c 11.1.0 - Denial of Service Attack vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-48888",
"datePublished": "2026-09-08T07:25:20.910Z",
"dateReserved": "2026-05-25T22:37:16.413Z",
"dateUpdated": "2026-09-08T10:34:56.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57777 (GCVE-0-2026-57777)
Vulnerability from cvelistv5 – Published: 2026-09-04 08:12 – Updated: 2026-09-04 16:36 X_Open Source
VLAI
EPSS
VEX
Title
WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection.
This issue affects WooCommerce: from n/a before 11.0.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 16:36 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
| https://github.com/woocommerce/woocommerce/pull/67554 | issue-trackingpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WooCommerce |
Affected:
n/a , < 11.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57777",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T16:36:31.465841Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T16:36:55.172Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "woocommerce",
"product": "WooCommerce",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "11.0",
"status": "unaffected"
}
],
"lessThan": "11.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Automattic WooCommerce allows Blind SQL Injection.\u003cp\u003eThis issue affects WooCommerce: from n/a before 11.0.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Automattic WooCommerce allows Blind SQL Injection.\n\nThis issue affects WooCommerce: from n/a before 11.0."
}
],
"impacts": [
{
"capecId": "CAPEC-7",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-7 Blind SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T08:12:00.611Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-10-9-4-sql-injection-vulnerability?_s_id=cve"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/woocommerce/woocommerce/pull/67554"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WooCommerce Plugin to the latest available version (at least 11.0)."
}
],
"value": "Update the WordPress WooCommerce Plugin to the latest available version (at least 11.0)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress WooCommerce plugin \u003c 11.0 - SQL Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-57777",
"datePublished": "2026-09-04T08:12:00.611Z",
"dateReserved": "2026-06-25T08:04:53.458Z",
"dateUpdated": "2026-09-04T16:36:55.172Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73562 (GCVE-0-2026-73562)
Vulnerability from cvelistv5 – Published: 2026-08-13 17:27 – Updated: 2026-08-14 18:09
VLAI
EPSS
VEX
Title
Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
Summary
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOne(filter, req.body) can exploit Mongoose update casting with a __proto__.x dotted path under $set. Schema.prototype.path and Schema.prototype._getPathType can treat inherited properties of schema.paths and schema.nested as schema types, allowing the casting process to set $fullPath and $parentSchemaDocArray on Object.prototype before throwing. This prototype pollution makes those properties visible on newly created objects and can cause application integrity and availability impacts. This issue is fixed in versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 17:41 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Automattic/mongoose/security/a… | x_refsource_CONFIRM |
| https://github.com/Automattic/mongoose/commit/35a… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/commit/728… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/commit/953… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/commit/fab… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | mongoose |
Affected:
< 6.13.10
Affected: >= 7.0.0, < 7.8.10 Affected: >= 8.0.0, < 8.24.1 Affected: >= 9.0.0, < 9.7.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73562",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T17:41:16.928150Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T18:09:27.112Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mongoose",
"vendor": "Automattic",
"versions": [
{
"status": "affected",
"version": "\u003c 6.13.10"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c 7.8.10"
},
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.24.1"
},
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c 9.7.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOne(filter, req.body) can exploit Mongoose update casting with a __proto__.x dotted path under $set. Schema.prototype.path and Schema.prototype._getPathType can treat inherited properties of schema.paths and schema.nested as schema types, allowing the casting process to set $fullPath and $parentSchemaDocArray on Object.prototype before throwing. This prototype pollution makes those properties visible on newly created objects and can cause application integrity and availability impacts. This issue is fixed in versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T17:27:09.914Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw"
},
{
"name": "https://github.com/Automattic/mongoose/commit/35a3f33bc9a0a28671f99e3c5010000425650d0f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/35a3f33bc9a0a28671f99e3c5010000425650d0f"
},
{
"name": "https://github.com/Automattic/mongoose/commit/7285466b860d3b511f8d07b2ab72656703ee707a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/7285466b860d3b511f8d07b2ab72656703ee707a"
},
{
"name": "https://github.com/Automattic/mongoose/commit/953d085bee5a16b5d6c5af33a156e6314d6d9a45",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/953d085bee5a16b5d6c5af33a156e6314d6d9a45"
},
{
"name": "https://github.com/Automattic/mongoose/commit/fab793b747131c68927888cba41cf3e6d6593740",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/fab793b747131c68927888cba41cf3e6d6593740"
}
],
"source": {
"advisory": "GHSA-664h-wqgq-64gw",
"discovery": "UNKNOWN"
},
"title": "Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73562",
"datePublished": "2026-08-13T17:27:09.914Z",
"dateReserved": "2026-08-12T20:53:46.380Z",
"dateUpdated": "2026-08-14T18:09:27.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42334 (GCVE-0-2026-42334)
Vulnerability from cvelistv5 – Published: 2026-05-14 18:03 – Updated: 2026-05-14 18:18
VLAI
EPSS
VEX
Title
Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
Summary
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-14 18:17 UTC
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/Automattic/mongoose/security/a… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | mongoose |
Affected:
< 6.13.9
Affected: >= 7.0.0, <= 7.8.8 Affected: >= 8.0.0, <= 8.22.0 Affected: >= 9.0.0, <= 9.1.5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42334",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-14T18:17:58.426797Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T18:18:06.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mongoose",
"vendor": "Automattic",
"versions": [
{
"status": "affected",
"version": "\u003c 6.13.9"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c= 7.8.8"
},
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c= 8.22.0"
},
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c= 9.1.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose\u2019s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T18:03:43.196Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h"
}
],
"source": {
"advisory": "GHSA-wpg9-53fq-2r8h",
"discovery": "UNKNOWN"
},
"title": "Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42334",
"datePublished": "2026-05-14T18:03:43.196Z",
"dateReserved": "2026-04-26T13:26:14.514Z",
"dateUpdated": "2026-05-14T18:18:06.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4338 (GCVE-0-2026-4338)
Vulnerability from cvelistv5 – Published: 2026-04-08 06:00 – Updated: 2026-04-08 16:06
VLAI
EPSS
VEX
Title
ActivityPub Routing < 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure
Summary
The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-08 16:06 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/50f68395-72fc-4f… | exploitvdb-entrytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | ActivityPub |
Affected:
0 , < 8.0.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-4338",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-08T16:06:38.334257Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:06:53.365Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ActivityPub",
"vendor": "Unknown",
"versions": [
{
"lessThan": "8.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ryuk (kos0ng)"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T06:00:08.001Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/50f68395-72fc-4f99-8e6d-6aa90cc640b5/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ActivityPub Routing \u003c 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-4338",
"datePublished": "2026-04-08T06:00:08.001Z",
"dateReserved": "2026-03-17T14:54:23.077Z",
"dateUpdated": "2026-04-08T16:06:53.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3589 (GCVE-0-2026-3589)
Vulnerability from cvelistv5 – Published: 2026-03-06 09:11 – Updated: 2026-03-06 17:44
VLAI
EPSS
VEX
Title
WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF
Summary
The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-06 17:44 UTC
CWE
- CWE-352 Cross-Site Request Forgery (CSRF)
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/53ded097-274d-48… | exploitvdb-entrytechnical-description |
| https://developer.woocommerce.com/2026/03/02/stor… | technical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WooCommerce |
Affected:
5.4.0 , < 5.4.4
(semver)
Affected: 5.5.0 , < 5.4.5 (semver) Affected: 5.6.0 , < 5.6.3 (semver) Affected: 5.7.0 , < 5.7.3 (semver) Affected: 5.8.0 , < 5.8.2 (semver) Affected: 5.9.0 , < 5.9.2 (semver) Affected: 6.0.0 , < 6.0.2 (semver) Affected: 6.1.0 , < 6.1.3 (semver) Affected: 6.2.0 , < 6.2.3 (semver) Affected: 6.3.0 , < 6.3.2 (semver) Affected: 6.4.0 , < 6.4.2 (semver) Affected: 6.5.0 , < 6.5.2 (semver) Affected: 6.6.0 , < 6.6.2 (semver) Affected: 6.7.0 , < 6.7.1 (semver) Affected: 6.8.0 , < 6.8.3 (semver) Affected: 6.9.0 , < 6.9.5 (semver) Affected: 7.0.0 , < 7.0.2 (semver) Affected: 7.1.0 , < 7.1.2 (semver) Affected: 7.2.0 , < 7.2.4 (semver) Affected: 7.3.0 , < 7.3.1 (semver) Affected: 7.4.0 , < 7.4.2 (semver) Affected: 7.5.0 , < 7.5.2 (semver) Affected: 7.6.0 , < 7.6.2 (semver) Affected: 7.7.0 , < 7.7.3 (semver) Affected: 7.8.0 , < 7.8.4 (semver) Affected: 7.9.0 , < 7.9.2 (semver) Affected: 8.0.0 , < 8.0.5 (semver) Affected: 8.1.0 , < 8.1.4 (semver) Affected: 8.2.0 , < 8.2.5 (semver) Affected: 8.3.0 , < 8.3.4 (semver) Affected: 8.4.0 , < 8.4.3 (semver) Affected: 8.5.0 , < 8.5.5 (semver) Affected: 8.6.0 , < 8.6.4 (semver) Affected: 8.7.0 , < 8.7.3 (semver) Affected: 8.8.0 , < 8.8.7 (semver) Affected: 8.9.0 , < 8.9.5 (semver) Affected: 9.0.0 , < 9.0.4 (semver) Affected: 9.1.0 , < 9.1.7 (semver) Affected: 9.2.0 , < 9.2.5 (semver) Affected: 9.3.0 , < 9.3.6 (semver) Affected: 9.4.0 , < 9.4.5 (semver) Affected: 9.5.0 , < 9.5.4 (semver) Affected: 9.6.0 , < 9.6.4 (semver) Affected: 9.7.0 , < 9.7.3 (semver) Affected: 9.8.0 , < 9.8.7 (semver) Affected: 9.9.0 , < 9.9.7 (semver) Affected: 10.0.0 , < 10.0.6 (semver) Affected: 10.1.0 , < 10.1.4 (semver) Affected: 10.2.0 , < 10.2.4 (semver) Affected: 10.3.0 , < 10.3.8 (semver) Affected: 10.4.0 , < 10.4.4 (semver) Affected: 10.5.0 , < 10.5.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-3589",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-06T17:44:54.283745Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T17:44:58.613Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "WooCommerce",
"vendor": "Automattic",
"versions": [
{
"lessThan": "5.4.4",
"status": "affected",
"version": "5.4.0",
"versionType": "semver"
},
{
"lessThan": "5.4.5",
"status": "affected",
"version": "5.5.0",
"versionType": "semver"
},
{
"lessThan": "5.6.3",
"status": "affected",
"version": "5.6.0",
"versionType": "semver"
},
{
"lessThan": "5.7.3",
"status": "affected",
"version": "5.7.0",
"versionType": "semver"
},
{
"lessThan": "5.8.2",
"status": "affected",
"version": "5.8.0",
"versionType": "semver"
},
{
"lessThan": "5.9.2",
"status": "affected",
"version": "5.9.0",
"versionType": "semver"
},
{
"lessThan": "6.0.2",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThan": "6.1.3",
"status": "affected",
"version": "6.1.0",
"versionType": "semver"
},
{
"lessThan": "6.2.3",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThan": "6.3.2",
"status": "affected",
"version": "6.3.0",
"versionType": "semver"
},
{
"lessThan": "6.4.2",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"lessThan": "6.5.2",
"status": "affected",
"version": "6.5.0",
"versionType": "semver"
},
{
"lessThan": "6.6.2",
"status": "affected",
"version": "6.6.0",
"versionType": "semver"
},
{
"lessThan": "6.7.1",
"status": "affected",
"version": "6.7.0",
"versionType": "semver"
},
{
"lessThan": "6.8.3",
"status": "affected",
"version": "6.8.0",
"versionType": "semver"
},
{
"lessThan": "6.9.5",
"status": "affected",
"version": "6.9.0",
"versionType": "semver"
},
{
"lessThan": "7.0.2",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThan": "7.1.2",
"status": "affected",
"version": "7.1.0",
"versionType": "semver"
},
{
"lessThan": "7.2.4",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThan": "7.3.1",
"status": "affected",
"version": "7.3.0",
"versionType": "semver"
},
{
"lessThan": "7.4.2",
"status": "affected",
"version": "7.4.0",
"versionType": "semver"
},
{
"lessThan": "7.5.2",
"status": "affected",
"version": "7.5.0",
"versionType": "semver"
},
{
"lessThan": "7.6.2",
"status": "affected",
"version": "7.6.0",
"versionType": "semver"
},
{
"lessThan": "7.7.3",
"status": "affected",
"version": "7.7.0",
"versionType": "semver"
},
{
"lessThan": "7.8.4",
"status": "affected",
"version": "7.8.0",
"versionType": "semver"
},
{
"lessThan": "7.9.2",
"status": "affected",
"version": "7.9.0",
"versionType": "semver"
},
{
"lessThan": "8.0.5",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThan": "8.1.4",
"status": "affected",
"version": "8.1.0",
"versionType": "semver"
},
{
"lessThan": "8.2.5",
"status": "affected",
"version": "8.2.0",
"versionType": "semver"
},
{
"lessThan": "8.3.4",
"status": "affected",
"version": "8.3.0",
"versionType": "semver"
},
{
"lessThan": "8.4.3",
"status": "affected",
"version": "8.4.0",
"versionType": "semver"
},
{
"lessThan": "8.5.5",
"status": "affected",
"version": "8.5.0",
"versionType": "semver"
},
{
"lessThan": "8.6.4",
"status": "affected",
"version": "8.6.0",
"versionType": "semver"
},
{
"lessThan": "8.7.3",
"status": "affected",
"version": "8.7.0",
"versionType": "semver"
},
{
"lessThan": "8.8.7",
"status": "affected",
"version": "8.8.0",
"versionType": "semver"
},
{
"lessThan": "8.9.5",
"status": "affected",
"version": "8.9.0",
"versionType": "semver"
},
{
"lessThan": "9.0.4",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"lessThan": "9.1.7",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
},
{
"lessThan": "9.2.5",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
},
{
"lessThan": "9.3.6",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
},
{
"lessThan": "9.4.5",
"status": "affected",
"version": "9.4.0",
"versionType": "semver"
},
{
"lessThan": "9.5.4",
"status": "affected",
"version": "9.5.0",
"versionType": "semver"
},
{
"lessThan": "9.6.4",
"status": "affected",
"version": "9.6.0",
"versionType": "semver"
},
{
"lessThan": "9.7.3",
"status": "affected",
"version": "9.7.0",
"versionType": "semver"
},
{
"lessThan": "9.8.7",
"status": "affected",
"version": "9.8.0",
"versionType": "semver"
},
{
"lessThan": "9.9.7",
"status": "affected",
"version": "9.9.0",
"versionType": "semver"
},
{
"lessThan": "10.0.6",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
},
{
"lessThan": "10.1.4",
"status": "affected",
"version": "10.1.0",
"versionType": "semver"
},
{
"lessThan": "10.2.4",
"status": "affected",
"version": "10.2.0",
"versionType": "semver"
},
{
"lessThan": "10.3.8",
"status": "affected",
"version": "10.3.0",
"versionType": "semver"
},
{
"lessThan": "10.4.4",
"status": "affected",
"version": "10.4.0",
"versionType": "semver"
},
{
"lessThan": "10.5.3",
"status": "affected",
"version": "10.5.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "oolongeya"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T09:11:10.949Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553/"
},
{
"tags": [
"technical-description"
],
"url": "https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WooCommerce \u003c 10.5.3 - Arbitrary Admin User Creation via CSRF",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-3589",
"datePublished": "2026-03-06T09:11:10.949Z",
"dateReserved": "2026-03-05T10:41:21.729Z",
"dateUpdated": "2026-03-06T17:44:58.613Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22356 (GCVE-0-2026-22356)
Vulnerability from cvelistv5 – Published: 2026-02-20 15:47 – Updated: 2026-04-28 16:48
VLAI
EPSS
VEX
Title
WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability
Summary
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Automattic Jetpack CRM zero-bs-crm allows PHP Local File Inclusion.This issue affects Jetpack CRM: from n/a through <= 6.7.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-24 20:06 UTC
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | Jetpack CRM |
Affected:
0 , ≤ 6.7.0
(custom)
|
Date Public
2026-04-01 16:03
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22356",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T20:06:14.780720Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:48:37.720Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "zero-bs-crm",
"product": "Jetpack CRM",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "6.7.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.7.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Skalucy | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-01T16:03:55.962Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027) vulnerability in Automattic Jetpack CRM zero-bs-crm allows PHP Local File Inclusion.\u003cp\u003eThis issue affects Jetpack CRM: from n/a through \u003c= 6.7.0.\u003c/p\u003e"
}
],
"value": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027) vulnerability in Automattic Jetpack CRM zero-bs-crm allows PHP Local File Inclusion.This issue affects Jetpack CRM: from n/a through \u003c= 6.7.0."
}
],
"impacts": [
{
"capecId": "CAPEC-252",
"descriptions": [
{
"lang": "en",
"value": "PHP Local File Inclusion"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:14:41.261Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/zero-bs-crm/vulnerability/wordpress-jetpack-crm-plugin-6-7-0-local-file-inclusion-vulnerability?_s_id=cve"
}
],
"title": "WordPress Jetpack CRM plugin \u003c= 6.7.0 - Local File Inclusion vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-22356",
"datePublished": "2026-02-20T15:47:01.362Z",
"dateReserved": "2026-01-07T12:21:24.564Z",
"dateUpdated": "2026-04-28T16:48:37.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25404 (GCVE-0-2026-25404)
Vulnerability from cvelistv5 – Published: 2026-02-19 08:27 – Updated: 2026-04-28 16:14
VLAI
EPSS
VEX
Title
WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager: from n/a through <= 2.4.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-24 21:14 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WP Job Manager |
Affected:
0 , ≤ 2.4.0
(custom)
|
Date Public
2026-04-01 16:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T21:14:57.107690Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T13:14:50.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-job-manager",
"product": "WP Job Manager",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "2.4.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Jay Neale | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-01T16:05:08.121Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects WP Job Manager: from n/a through \u003c= 2.4.0.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager: from n/a through \u003c= 2.4.0."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:14:58.267Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/wp-job-manager/vulnerability/wordpress-wp-job-manager-plugin-2-4-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"title": "WordPress WP Job Manager plugin \u003c= 2.4.0 - Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-25404",
"datePublished": "2026-02-19T08:27:04.284Z",
"dateReserved": "2026-02-02T12:53:19.000Z",
"dateUpdated": "2026-04-28T16:14:58.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-54332 (GCVE-0-2023-54332)
Vulnerability from cvelistv5 – Published: 2026-01-13 22:56 – Updated: 2026-05-24 01:37
VLAI
EPSS
VEX
Title
Jetpack 11.4 - Cross Site Scripting (XSS)
Summary
Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 15:02 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/51104 | exploit |
| https://wordpress.org/plugins/jetpack | product |
| https://www.vulncheck.com/advisories/jetpack-cros… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | Jetpack |
Affected:
11.4
cpe:2.3:a:automattic:jetpack_boost:11.4:*:*:*:*:*:*:* |
Date Public
2022-10-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-54332",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T15:02:29.264946Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T15:02:35.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jetpack",
"vendor": "Automattic",
"versions": [
{
"status": "affected",
"version": "11.4"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:automattic:jetpack_boost:11.4:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Behrouz Mansoori"
}
],
"datePublic": "2022-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims\u0027 browsers when they interact with the contact form page."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-24T01:37:37.697Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "ExploitDB-51104",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/51104"
},
{
"name": "Jetpack WordPress Plugin Homepage",
"tags": [
"product"
],
"url": "https://wordpress.org/plugins/jetpack"
},
{
"name": "VulnCheck Advisory: Jetpack 11.4 - Cross Site Scripting (XSS)",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jetpack-cross-site-scripting-xss"
}
],
"title": "Jetpack 11.4 - Cross Site Scripting (XSS)",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-54332",
"datePublished": "2026-01-13T22:56:39.597Z",
"dateReserved": "2026-01-10T01:51:52.983Z",
"dateUpdated": "2026-05-24T01:37:37.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-52212 (GCVE-0-2023-52212)
Vulnerability from cvelistv5 – Published: 2026-01-05 13:32 – Updated: 2026-04-28 16:09 X_Open Source
VLAI
EPSS
VEX
Title
WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability
Summary
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-05 21:17 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://vdp.patchstack.com/database/wordpress/plu… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | WP Job Manager |
Affected:
n/a , ≤ 2.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-52212",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-05T21:17:41.837689Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T21:17:55.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-job-manager",
"product": "WP Job Manager",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "2.1.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "2.0.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Rafie Muhammad | Patchstack Threat Intelligence"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.\u003cp\u003eThis issue affects WP Job Manager: from n/a through 2.0.0.\u003c/p\u003e"
}
],
"value": "Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-62 Cross Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:09:06.920Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://vdp.patchstack.com/database/wordpress/plugin/wp-job-manager/vulnerability/wordpress-wp-job-manager-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WP Job Manager plugin to the latest available version (at least 2.1.0)."
}
],
"value": "Update the WordPress WP Job Manager plugin to the latest available version (at least 2.1.0)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress WP Job Manager plugin \u003c= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2023-52212",
"datePublished": "2026-01-05T13:32:30.854Z",
"dateReserved": "2023-12-29T12:26:03.425Z",
"dateUpdated": "2026-04-28T16:09:06.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-69015 (GCVE-0-2025-69015)
Vulnerability from cvelistv5 – Published: 2025-12-30 10:47 – Updated: 2026-04-28 16:14
VLAI
EPSS
VEX
Title
WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-30 14:32 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | Crowdsignal Forms |
Affected:
0 , ≤ 1.7.2
(custom)
|
Date Public
2026-04-22 14:23
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-69015",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-30T14:32:01.594432Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-27T19:44:40.305Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "crowdsignal-forms",
"product": "Crowdsignal Forms",
"vendor": "Automattic",
"versions": [
{
"changes": [
{
"at": "1.8.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Doan Dinh Van | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-22T14:23:01.051Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Crowdsignal Forms: from n/a through \u003c= 1.7.2.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through \u003c= 1.7.2."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.8,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:14:34.426Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/crowdsignal-forms/vulnerability/wordpress-crowdsignal-forms-plugin-1-7-2-broken-access-control-vulnerability?_s_id=cve"
}
],
"title": "WordPress Crowdsignal Forms plugin \u003c= 1.7.2 - Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2025-69015",
"datePublished": "2025-12-30T10:47:53.892Z",
"dateReserved": "2025-12-29T11:18:30.572Z",
"dateUpdated": "2026-04-28T16:14:34.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}