{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-111311", "aliases": [], "title": "DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More：コード実行", "summary": "DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & Moreにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "product": "DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 8.8, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More", "range": "<= 1.5.1" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111311", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/browser/doublescale/tags/1.4.6/includes/Core/Services/AttachmentService.php#L112", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/doublescale/tags/1.4.6/includes/Core/Services/AttachmentService.php#L446", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/doublescale/tags/1.4.6/includes/Modules/Support/Rest/Controllers/RestPortalController.php#L574", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/doublescale/tags/1.4.6/includes/Modules/Support/Rest/Controllers/RestPortalController.php#L622", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0feed03e-fedf-4443-94e0-fbb2c8baba71?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T09:17:04.250Z", "modifiedAt": "2026-10-16T14:51:17.720Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.", "sourceTitle": "CVE-2026-111311", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "samuelgallegos", "product": "DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "1.5.1", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T14:51:17.720Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-109224", "aliases": [], "title": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments：ブラウザー上での不正な処理", "summary": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Paymentsにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "product": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments", "range": "<= 4.9.4" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109224", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/browser/surecart/tags/4.9.4/app/src/BlockLibrary/BlockServiceProvider.php#L100", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/surecart/tags/4.9.4/app/src/BlockLibrary/BlockServiceProvider.php#L152", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/surecart/tags/4.9.4/app/src/Support/kses.json#L216", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/surecart/tags/4.9.4/dist/components/esm/sc-cart-loader.entry.js#L33", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3742278%40surecart&new=3742278%40surecart", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa247ff-fbc3-48e3-8e90-e3f8cdf5d97f?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T09:17:04.113Z", "modifiedAt": "2026-10-16T15:17:06.923Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the affected comment to appear on a post that loads the surecart-components runtime (e.g. via a [sc_buy_button] shortcode) and contains no sc-checkout element, as these conditions trigger the innerHTML sink in sc-cart-loader.", "sourceTitle": "CVE-2026-109224", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "surecart", "product": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "4.9.4", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:06.923Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-104726", "aliases": [], "title": "Name Directory：ブラウザー上での不正な処理", "summary": "Name Directoryにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "product": "Name Directory", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.4, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Name Directory", "range": "<= 1.34.2" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104726", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/browser/name-directory/tags/1.34.3/shortcode.php#L284", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/name-directory/tags/1.34.3/shortcode.php#L344", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3723785%40name-directory&new=3723785%40name-directory", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ea92622-60df-43ab-a106-56b769964a75?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T09:17:03.980Z", "modifiedAt": "2026-10-16T15:17:03.353Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "sourceTitle": "CVE-2026-104726", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "jeroenpeters1986", "product": "Name Directory", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "1.34.2", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:03.353Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ] }, { "id": "CVE-2026-104003", "aliases": [], "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress：脆弱性情報", "summary": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePressに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.4, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "affected": [ { "product": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress", "range": "<= 4.17.5" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104003", "label": "NVDの原文" }, { "url": "https://pastebin.com/raw/pCgrW6Pf", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.5/src/Functions/GlobalFunctions.php#L1768", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.5/src/ShortcodeParser/Builder/FrontendProfileBuilder.php#L169", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.5/src/ShortcodeParser/FrontendProfileTag.php#L142", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.5/src/Themes/DragDrop/UserProfile/DefaultTemplate.php#L379", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.6/src/ShortcodeParser/FrontendProfileTag.php", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83adfbff-f625-4474-81b9-961c496d59a0?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T09:17:03.843Z", "modifiedAt": "2026-10-16T15:17:03.103Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by author_comment_query() — and passing the entire buffer to do_shortcode() after only a narrow neutralization pass (ppress_neutralize_buffer_shortcodes) that blocks pp-custom-html and bracket fragments containing HTML delimiters but leaves any other well-formed shortcode intact. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary shortcodes (from any active plugin or theme) with attacker-chosen attributes by posting a comment whose body contains the shortcode markup; the shortcode is then executed server-side when any visitor loads the target's front-end profile Comments tab, letting the attacker reach capability-gated or data-returning shortcodes and inject raw HTML markup into a publicly viewable page.", "sourceTitle": "CVE-2026-104003", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "properfraction", "product": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "4.17.5", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:03.103Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ] }, { "id": "CVE-2026-96870", "aliases": [], "title": "SureDash – Community, Courses & Member Dashboard：ブラウザー上での不正な処理", "summary": "SureDash – Community, Courses & Member Dashboardにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "product": "SureDash – Community, Courses & Member Dashboard", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.4, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "SureDash – Community, Courses & Member Dashboard", "range": "<= 1.12.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96870", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/assets/js/minified/common.min.js#L58", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/core/routers/misc.php#L647", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/core/routes.php#L121", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/inc/functions/functions.php#L1037", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/inc/functions/functions.php#L1111", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.12.0/inc/services/router.php#L127", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3721168%40suredash%2Ftags%2F1.12.1&old=3694773%40suredash%2Ftags%2F1.12.0", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ece14f57-475d-4efc-8daf-52dfdaa12697?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T08:17:13.783Z", "modifiedAt": "2026-10-16T15:17:37.933Z", "fetchedAt": "2026-10-22T22:09:50.314Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.", "sourceTitle": "CVE-2026-96870", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "brainstormforce", "product": "SureDash – Community, Courses & Member Dashboard", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "1.12.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:37.933Z", "fetchedAt": "2026-10-22T22:09:50.314Z", "state": "published" } ] }, { "id": "CVE-2026-87111", "aliases": [], "title": "User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin：ブラウザー上での不正な処理", "summary": "User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Pluginにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "product": "User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin", "range": "<= 6.2.9" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87111", "label": "NVDの原文" }, { "url": "https://wpuserregistration.com/changelog/", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/493ac933-f2b3-487b-8fc7-af2df9b0d460?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T08:17:13.650Z", "modifiedAt": "2026-10-16T15:17:33.417Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.", "sourceTitle": "CVE-2026-87111", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "WPEverest", "product": "User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "6.2.9", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:33.417Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-75903", "aliases": [], "title": "Vulnity Security：認証の回避", "summary": "Vulnity Securityに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "product": "Vulnity Security", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Vulnity Security", "range": "<= 1.4.3" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75903", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/changeset/3719370/vulnity/trunk/includes/class-static-security.php", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3719373%40vulnity%2Ftags%2F1.4.4&old=3717813%40vulnity%2Ftags%2F1.4.3", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5574a52f-cec8-4f79-a3a7-5c13272e5e17?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T08:17:13.513Z", "modifiedAt": "2026-10-16T15:17:33.190Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.", "sourceTitle": "CVE-2026-75903", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "manuelgalan", "product": "Vulnity Security", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "1.4.3", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:33.190Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-100108", "aliases": [], "title": "Social Share Buttons：ブラウザー上での不正な処理", "summary": "Social Share Buttonsにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "product": "Social Share Buttons", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.4, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Social Share Buttons", "range": "<= 1.30" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100108", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/browser/share-button/tags/1.30/admin/review_notice.php#L26", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/share-button/tags/1.30/classes/blocks/network-block.php#L47", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/share-button/tags/1.30/classes/class-network.php#L275", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/share-button/tags/1.30/classes/class-social-networks.php#L370", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/share-button/tags/1.30/classes/class-social.php#L60", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3735252%40share-button&new=3735252%40share-button", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bc098f5d-3c59-4046-bce8-ac2586e6da19?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T08:17:12.320Z", "modifiedAt": "2026-10-16T15:16:57.843Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 7-day review-nag timer has elapsed since the attacker's first wp-admin visit, as the nonce needed to reach the save-network handler is only rendered in the DOM once that timer has passed.", "sourceTitle": "CVE-2026-100108", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "maxfoundry", "product": "Social Share Buttons", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "1.30", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:16:57.843Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ] }, { "id": "CVE-2026-100106", "aliases": [], "title": "FiboSearch – Ajax Search for WooCommerce：ブラウザー上での不正な処理", "summary": "FiboSearch – Ajax Search for WooCommerceにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "product": "FiboSearch – Ajax Search for WooCommerce", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.4, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "FiboSearch – Ajax Search for WooCommerce", "range": "<= 1.34.2" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100106", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.34.2/assets/js/admin.js#L555", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.34.2/assets/js/tooltip.min.js#L4", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.34.2/vendor/freemius/wordpress-sdk/includes/class-freemius.php#L4548", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.34.2/vendor/freemius/wordpress-sdk/includes/fs-core-functions.php#L223", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.34.2/vendor/freemius/wordpress-sdk/includes/fs-html-escaping-functions.php#L123", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.34.2/vendor/freemius/wordpress-sdk/includes/managers/class-fs-admin-notice-manager.php#L421", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.34.2/vendor/freemius/wordpress-sdk/templates/admin-notice.php#L110", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3734423%40ajax-search-for-woocommerce%2Ftags%2F1.34.3&old=3684506%40ajax-search-for-woocommerce%2Ftags%2F1.34.2", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7db3475a-3a70-4776-8ea3-337192f88973?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T08:17:11.207Z", "modifiedAt": "2026-10-16T15:16:57.717Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site owner has previously completed the standard Freemius opt-in flow; once that condition is met, any Subscriber can reach the vulnerable handler simply by loading /wp-admin/profile.php with the requisite query parameters.", "sourceTitle": "CVE-2026-100106", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "damian-gora", "product": "FiboSearch – Ajax Search for WooCommerce", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "1.34.2", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:16:57.717Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ] }, { "id": "CVE-2026-97640", "aliases": [], "title": "WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)：ブラウザー上での不正な処理", "summary": "WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)にブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "product": "WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)", "range": "<= 1.1.9" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97640", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/browser/wpconsent-cookies-banner-privacy-suite/tags/1.1.9/includes/class-wpconsent-cookie-blocking.php#L107", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wpconsent-cookies-banner-privacy-suite/tags/1.1.9/includes/class-wpconsent-cookie-blocking.php#L222", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wpconsent-cookies-banner-privacy-suite/tags/1.1.9/lib/simplehtmldom/class-wpconsent-simple-html-dom.php#L2135", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wpconsent-cookies-banner-privacy-suite/tags/1.1.9/lib/simplehtmldom/class-wpconsent-simple-html-dom.php#L2236", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wpconsent-cookies-banner-privacy-suite/tags/1.1.9/lib/simplehtmldom/class-wpconsent-simple-html-dom.php#L466", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3734401/wpconsent-cookies-banner-privacy-suite/trunk/lib/simplehtmldom/class-wpconsent-simple-html-dom.php", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3734409%40wpconsent-cookies-banner-privacy-suite&old=3676065%40wpconsent-cookies-banner-privacy-suite", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e92b4189-bd07-4d29-8fe1-e9de60107e70?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T07:17:14.823Z", "modifiedAt": "2026-10-16T15:17:38.253Z", "fetchedAt": "2026-10-22T22:09:50.314Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Script Blocking feature to be enabled, and the exploit chain depends on an attacker submitting two coordinated comments — one embedding event-handler syntax inside an allowed <code> element and one placing the deterministic ___noise___ restoration key inside an allowed <abbr title=\"\"> attribute — with the key offset confirmable via an unauthenticated wpconsent_debug=1 request.", "sourceTitle": "CVE-2026-97640", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "smub", "product": "WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "1.1.9", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:38.253Z", "fetchedAt": "2026-10-22T22:09:50.314Z", "state": "published" } ] }, { "id": "CVE-2026-92553", "aliases": [], "title": "YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports：コード実行", "summary": "YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reportsにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "product": "YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 8.8, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports", "range": "<= 2.7.7" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92553", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/browser/yaysmtp/tags/2.7.7/includes/Helper/EmailLogAttachments.php#L106", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/yaysmtp/tags/2.7.7/includes/Helper/EmailLogAttachments.php#L178", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/yaysmtp/tags/2.7.7/includes/Helper/EmailLogAttachments.php#L542", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/yaysmtp/tags/2.7.7/includes/Helper/EmailLogAttachments.php#L549", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/yaysmtp/tags/2.7.7/includes/Helper/Utils.php#L814", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/yaysmtp/tags/2.7.7/includes/PluginCore.php#L37", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3739875/yaysmtp/trunk/includes/Helper/EmailLogAttachments.php", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4abbf148-4648-440c-8a82-cf68bf051fbe?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T07:17:14.150Z", "modifiedAt": "2026-10-16T15:17:35.653Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitize_file_name() does not strip executable extensions and no allow-list, MIME check, or safe-extension rename is applied. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The only server-side guard is a .htaccess file containing 'Require all denied' written by writeGuards(), which is silently ignored by nginx and by Apache configured with AllowOverride None, meaning RCE is fully achievable on those server configurations.", "sourceTitle": "CVE-2026-92553", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "yaycommerce", "product": "YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "2.7.7", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:35.653Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-92427", "aliases": [], "title": "Coinsnap Bitcoin Crowdfunding：脆弱性情報", "summary": "Coinsnap Bitcoin Crowdfundingに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Coinsnap Bitcoin Crowdfunding", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Coinsnap Bitcoin Crowdfunding", "range": "<= 1.2.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92427", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/a5320c81-5ad9-471d-9c58-726b585b801e/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-16T07:17:14.047Z", "modifiedAt": "2026-10-16T15:17:35.510Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.", "sourceTitle": "CVE-2026-92427", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Coinsnap Bitcoin Crowdfunding", "defaultStatus": "unknown", "versions": [ { "version": "0", "lessThanOrEqual": "1.2.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:35.510Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-92115", "aliases": [], "title": "WP Photo Album Plus：コード実行", "summary": "WP Photo Album Plusにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "product": "WP Photo Album Plus", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 8.8, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "WP Photo Album Plus", "range": "<= 9.3.02.002" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92115", "label": "NVDの原文" }, { "url": "https://downloads.wordpress.org/plugin/wp-photo-album-plus.9.3.02.003.zip", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-ajax.php#L2211", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-ajax.php#L2223", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-ajax.php#L2557", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-photo-files.php#L859", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-photo-files.php#L874", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc663d68-ca52-4012-847f-09817c121890?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T07:17:13.907Z", "modifiedAt": "2026-10-16T15:17:35.193Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.", "sourceTitle": "CVE-2026-92115", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "opajaap", "product": "WP Photo Album Plus", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "9.3.02.002", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:35.193Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-91833", "aliases": [], "title": "WX Subscribe 微信支付付费订阅：データベースへの不正操作", "summary": "WX Subscribe 微信支付付费订阅にデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "product": "WX Subscribe 微信支付付费订阅", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.8, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "affected": [ { "product": "WX Subscribe 微信支付付费订阅", "range": "<= 1.2.1" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91833", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/1086b82e-1105-4484-a49b-456ed5f45bf8/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-16T07:17:13.803Z", "modifiedAt": "2026-10-16T15:17:35.047Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.", "sourceTitle": "CVE-2026-91833", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "WX Subscribe 微信支付付费订阅", "defaultStatus": "unknown", "versions": [ { "version": "0", "lessThanOrEqual": "1.2.1", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:35.047Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-91830", "aliases": [], "title": "Subscribe to Comments：脆弱性情報", "summary": "Subscribe to Commentsに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Subscribe to Comments", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "affected": [ { "product": "Subscribe to Comments", "range": "< 2.3.3" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91830", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/b2b1638a-f8af-49f7-86a6-a3eeea0526b1/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-16T07:17:13.700Z", "modifiedAt": "2026-10-16T15:17:34.057Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.", "sourceTitle": "CVE-2026-91830", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Subscribe to Comments", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "2.3.3", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:34.057Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-74923", "aliases": [], "title": "Document Gallery：脆弱性情報", "summary": "Document Galleryに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Document Gallery", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "Document Gallery", "range": "<= 5.1.1" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74923", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/23254461-f638-4fb7-817b-776c0db18a67/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-16T07:17:13.487Z", "modifiedAt": "2026-10-16T15:17:32.990Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.", "sourceTitle": "CVE-2026-74923", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Document Gallery", "defaultStatus": "unknown", "versions": [ { "version": "0", "lessThanOrEqual": "5.1.1", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:32.990Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-19798", "aliases": [], "title": "WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters：脆弱性情報", "summary": "WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filtersに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters", "range": "<= 3.0.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19798", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-map-block/tags/3.0.0/includes/Rest/Maps_Controller.php#L124", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-map-block/tags/3.0.0/includes/Rest/Maps_Controller.php#L237", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-map-block/tags/3.0.0/includes/Rest/Maps_Controller.php#L262", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-map-block/tags/3.0.0/includes/Rest/Maps_Controller.php#L63", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3730836%40wp-map-block&new=3730836%40wp-map-block", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b42f1f71-e272-48d4-9b3f-4360b287e16f?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T07:17:13.217Z", "modifiedAt": "2026-10-16T15:17:15.747Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.", "sourceTitle": "CVE-2026-19798", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "tusharimran", "product": "WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "3.0.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:15.747Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-15222", "aliases": [], "title": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder：脆弱性情報", "summary": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builderに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.4, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "affected": [ { "product": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder", "range": "<= 5.2.8" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15222", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/class-ur-smart-tags.php", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f61873db-7365-41cb-a774-8f455a963d78?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T07:17:12.120Z", "modifiedAt": "2026-10-16T15:17:15.343Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.", "sourceTitle": "CVE-2026-15222", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "wpeverest", "product": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "5.2.8", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:15.343Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-111178", "aliases": [], "title": "WP Booking System – Booking Calendar：データベースへの不正操作", "summary": "WP Booking System – Booking Calendarにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "product": "WP Booking System – Booking Calendar", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.9, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "WP Booking System – Booking Calendar", "range": "<= 2.1.0.1" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111178", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.1/includes/abstracts/abstract-class-object-db.php#L83", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.1/includes/base/admin/booking/class-bookings-outputter.php#L214", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.1/includes/base/admin/booking/functions-actions-booking.php#L219", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.1/includes/base/booking/class-object-db-bookings.php#L165", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?old=3732620&old_path=%2Fwp-booking-system%2Ftrunk&new=&new_path=%2Fwp-booking-system%2Ftrunk", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3736389%40wp-booking-system%2Ftags%2F2.1.0.2&old=3732637%40wp-booking-system%2Ftags%2F2.1.0.1", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12923175-4db4-4afc-9e9b-b9f139f24a79?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T07:17:11.960Z", "modifiedAt": "2026-10-16T15:17:13.497Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the targeted calendar to have more than 200 bookings, as the orderby value is only forwarded to the database layer when the AJAX handler takes the use_ajax branch; an Administrator can satisfy this condition by creating bookings directly.", "sourceTitle": "CVE-2026-111178", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "murgroland", "product": "WP Booking System – Booking Calendar", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "2.1.0.1", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:13.497Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-111069", "aliases": [], "title": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory：ブラウザー上での不正な処理", "summary": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directoryにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "product": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.4, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory", "range": "<= 2.8.192" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111069", "label": "NVDの原文" }, { "url": "https://github.com/AyeCode/geodirectory/archive/refs/heads/master.zip", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.192/includes/class-geodir-ajax.php#L821", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.192/includes/class-geodir-post-data.php#L1661", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.192/includes/class-geodir-post-data.php#L450", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.192/includes/custom-fields/output-filter-functions.php#L42", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.192/includes/post-functions.php#L1950", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3748786/geodirectory/trunk/includes/custom-fields/output-filter-functions.php", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/32052509-2fa6-4317-8861-314e6da0869f?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-16T07:17:11.790Z", "modifiedAt": "2026-10-16T15:17:12.937Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The client-side HTML pattern attribute enforcing alphanumeric-only input on the twitterusername field is not validated server-side, allowing a listing owner with Subscriber-level access to submit an attribute-breakout payload that bypasses sanitization and is stored directly to the custom field table.", "sourceTitle": "CVE-2026-111069", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "paoltaia", "product": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "2.8.192", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-16T15:17:12.937Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] } ], "total": 328, "limit": 20, "offset": 180, "filters": { "product": "wordpress", "type": "all", "q": "", "page": 10 }, "pagination": { "page": 10, "pageSize": 20, "totalPages": 17 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-23T01:17:50.760Z", "lastAttempt": "2026-10-23T01:17:50.760Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "error", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-23T01:17:50.760Z", "error": "GitHub API取得上限に到達 (2026-10-23T01:56:27.000Z以降に再取得)", "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "stale", "stale": true }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-23T01:17:50.760Z", "lastAttempt": "2026-10-23T01:17:50.760Z", "error": null, "recordCount": 1754, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-23T01:17:50.760Z", "lastAttempt": "2026-10-23T01:17:50.760Z", "error": null, "recordCount": 0, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T00:02:50.236Z 〜 2026-10-23T01:17:50.760Z、全製品の変更 9/9件まで確認、対象0件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-23T01:17:50.760Z", "lastAttempt": "2026-10-23T01:17:50.760Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。 PHP公式ニュース経由で候補補足（先頭20項目から2件）。GitHub全件代替ではない。CVE取得は既存候補と合わせ最大6件。", "cursor": null, "freshness": "fresh", "stale": false } ] }