{
"schemaVersion": "1.0",
"publisher": "脆弱性ナビ",
"origin": "https://zeijaku.ittrip.xyz",
"terms": [
{
"name": "CVE Program",
"url": "https://www.cve.org/legal/termsofuse",
"notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.",
"licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."
},
{
"name": "NIST NVD",
"url": "https://nvd.nist.gov/general/faq",
"notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
},
{
"name": "JVN",
"url": "https://jvn.jp/contact/index.html",
"notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。"
},
{
"name": "CISA KEV",
"url": "https://github.com/cisagov/kev-data",
"notice": "Known Exploited Vulnerabilities catalog, CISA. CC0."
}
],
"records": [
{
"id": "CVE-2026-109207",
"aliases": [],
"title": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator：ブラウザー上での不正な処理",
"summary": "RSS Aggregator by Feedzy のバージョン 5.2.11 以下において、認証されていない攻撃者が RSS の media:thumbnail@url パラメータを通じて保存型クロスサイトスクリプティングを実行できる。",
"risk": "攻撃者が任意のウェブスクリプトを注入でき、ページを閲覧したユーザーのブラウザーでそのスクリプトが実行される可能性がある。",
"product": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator",
"category": "wordpress",
"component": "plugin",
"severity": "high",
"cvss": 7.2,
"cvssVersion": "3.1",
"cvssSource": "Wordfence",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"affected": [
{
"product": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator",
"range": "<= 5.2.11"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109207",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1d8bcb-688a-4763-970a-c960925cf0b6?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L1241",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L989",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2951",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L3413",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L2134",
"label": "security@wordfence.com"
},
{
"url": "https://downloads.wordpress.org/plugin/feedzy-rss-feeds.5.2.12.zip",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109207",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-10-16T03:38:42.150Z",
"modifiedAt": "2026-10-16T15:17:06.697Z",
"fetchedAt": "2026-10-23T02:43:43.094Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.",
"sourceTitle": "RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "themeisle",
"product": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "5.2.11",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-109207",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json",
"fetchedAt": "2026-10-23T02:43:43.094Z",
"publishedAt": "2026-10-16T03:38:42.150Z",
"modifiedAt": "2026-10-16T14:39:06.482Z",
"state": "published",
"provider": "Wordfence",
"title": "RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL",
"descriptions": [
{
"lang": "en",
"value": "The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "themeisle",
"product": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThanOrEqual": "5.2.11",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "CWE-79",
"lang": "en",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"provider": "Wordfence",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1d8bcb-688a-4763-970a-c960925cf0b6?source=cve",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/0"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L1241",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/1"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L989",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/2"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2951",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/3"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L3413",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/4"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L2134",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/5"
},
{
"url": "https://downloads.wordpress.org/plugin/feedzy-rss-feeds.5.2.12.zip",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/6"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"themeisle\",\"product\":\"RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"5.2.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1",
"text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-10-16T14:39:06.482Z",
"fetchedAt": "2026-10-23T02:43:43.094Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-16T15:17:06.697Z",
"fetchedAt": "2026-10-22T22:09:30.689Z",
"state": "published"
}
],
"sourceSummary": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregatorにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:21:08.815Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "4066dbbca90a171c2e19d28695c7af0924addef1341f5fc32bca1a01aeb18023",
"sourceModifiedAt": "2026-10-16T15:17:06.697Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "RSS Aggregator by Feedzy のバージョン 5.2.11 以下において、認証されていない攻撃者が RSS の media:thumbnail@url パラメータを通じて保存型クロスサイトスクリプティングを実行できる。",
"risk": "攻撃者が任意のウェブスクリプトを注入でき、ページを閲覧したユーザーのブラウザーでそのスクリプトが実行される可能性がある。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E2"
],
"applicability": [
{
"text": "影響を受けるバージョンは 5.2.11 までのすべてのバージョンである。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json"
],
"evidenceIds": [
"E3",
"E1"
]
},
{
"text": "認証されていない攻撃者でもこの脆弱性を利用できる。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "攻撃には、対象サイトがインポート用に設定している外部 RSS フィードを攻撃者が制御している必要がある。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "WordPress のアカウントや特別なプラグイン設定は不要である。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "公式の対象表：themeisle / RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator。影響ありとして記載：5.2.11以下の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-109207",
"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1d8bcb-688a-4763-970a-c960925cf0b6?source=cve",
"https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L1241",
"https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L989",
"https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2951",
"https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L3413",
"https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L2134",
"https://downloads.wordpress.org/plugin/feedzy-rss-feeds.5.2.12.zip",
"https://nvd.nist.gov/vuln/detail/CVE-2026-109207"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109207",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1d8bcb-688a-4763-970a-c960925cf0b6?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L1241",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L989",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2951",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L3413",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L2134",
"label": "security@wordfence.com"
},
{
"url": "https://downloads.wordpress.org/plugin/feedzy-rss-feeds.5.2.12.zip",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109207",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json",
"sourceField": "/containers/cna/title",
"excerpt": "RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL",
"language": null
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"themeisle\",\"product\":\"RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"5.2.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-109207（RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるバージョンは 5.2.11 までのすべてのバージョンである。\n・認証されていない攻撃者でもこの脆弱性を利用できる。\n・攻撃には、対象サイトがインポート用に設定している外部 RSS フィードを攻撃者が制御している必要がある。\n・WordPress のアカウントや特別なプラグイン設定は不要である。\n・公式の対象表：themeisle / RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator。影響ありとして記載：5.2.11以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109207",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:21:08.815Z",
"lastSuccess": "2026-10-23T03:21:08.815Z",
"sourceCheckedAt": "2026-10-23T02:43:43.094Z",
"errorCode": null
},
"glossary": [
{
"term": "XSS",
"meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。",
"sourceUrl": "https://cwe.mitre.org/data/definitions/79.html",
"kind": "general_definition"
}
]
}
},
{
"id": "CVE-2026-107758",
"aliases": [],
"title": "Colibri Page Builder：ブラウザー上での不正な処理",
"summary": "Colibri Page Builder プラグインは、バージョン 1.0.390 以下すべてで、コメントパラメータの入力検証と出力エスケープが不十分なため、認証されていない攻撃者が任意のウェブスクリプトを保存できる Stored Cross‑Site Scripting の脆弱性があります。コメントの許可リストが SVG 要素と任意の data-* 属性を許容しているためペイロードが保存され、フロントエンドで常に読み込まれる colibri.js が保存された data‑target 値を jQuery.data() で取得し HTML エンティティをデコードした上で jQuery() に渡すことで、ページを閲覧したユーザーのブラウザーでスクリプトが実行されます。",
"risk": "攻撃者が保存したスクリプトが、ページを表示した人のブラウザーで不正に実行されます。",
"product": "Colibri Page Builder",
"category": "wordpress",
"component": "plugin",
"severity": "high",
"cvss": 7.2,
"cvssVersion": "3.1",
"cvssSource": "Wordfence",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"affected": [
{
"product": "Colibri Page Builder",
"range": "<= 1.0.390"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-107758",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccae5cbd-cfe6-48b3-8bcd-0b08ceb94680?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L68",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L82",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L57",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L205",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L4",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107758",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-10-16T03:38:42.502Z",
"modifiedAt": "2026-10-16T15:17:05.540Z",
"fetchedAt": "2026-10-23T02:43:42.733Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.",
"sourceTitle": "Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "extendthemes",
"product": "Colibri Page Builder",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "1.0.390",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-107758",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json",
"fetchedAt": "2026-10-23T02:43:42.733Z",
"publishedAt": "2026-10-16T03:38:42.502Z",
"modifiedAt": "2026-10-16T14:39:06.338Z",
"state": "published",
"provider": "Wordfence",
"title": "Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments",
"descriptions": [
{
"lang": "en",
"value": "The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "extendthemes",
"product": "Colibri Page Builder",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThanOrEqual": "1.0.390",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "CWE-79",
"lang": "en",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"provider": "Wordfence",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccae5cbd-cfe6-48b3-8bcd-0b08ceb94680?source=cve",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/0"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L68",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/1"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L82",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/2"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L57",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/3"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L205",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/4"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L4",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/5"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"extendthemes\",\"product\":\"Colibri Page Builder\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.0.390\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1",
"text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-10-16T14:39:06.338Z",
"fetchedAt": "2026-10-23T02:43:42.733Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-16T15:17:05.540Z",
"fetchedAt": "2026-10-22T22:09:15.099Z",
"state": "published"
}
],
"sourceSummary": "Colibri Page Builderにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:21:09.088Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "fabb22dabc1645ae2957ccb75e7d7f170d91502093841aa3a4dc0450e9155b9d",
"sourceModifiedAt": "2026-10-16T15:17:05.540Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "Colibri Page Builder プラグインは、バージョン 1.0.390 以下すべてで、コメントパラメータの入力検証と出力エスケープが不十分なため、認証されていない攻撃者が任意のウェブスクリプトを保存できる Stored Cross‑Site Scripting の脆弱性があります。コメントの許可リストが SVG 要素と任意の data-* 属性を許容しているためペイロードが保存され、フロントエンドで常に読み込まれる colibri.js が保存された data‑target 値を jQuery.data() で取得し HTML エンティティをデコードした上で jQuery() に渡すことで、ページを閲覧したユーザーのブラウザーでスクリプトが実行されます。",
"risk": "攻撃者が保存したスクリプトが、ページを表示した人のブラウザーで不正に実行されます。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E1"
],
"applicability": [
{
"text": "Colibri Page Builder プラグインのバージョン 1.0.390 以下はすべて影響を受けます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json"
],
"evidenceIds": [
"E3",
"E2"
]
},
{
"text": "認証されていない攻撃者がコメントパラメータを通じてスクリプトを注入できます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "コメントの許可リストが SVG 要素と任意の data-* 属性を許容しているため、ペイロードが保存されます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "colibri.js がフロントエンドの全ページで読み込まれ、保存された data-target 値を jQuery.data() で取得します。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "取得した値は HTML エンティティがデコードされ、jQuery() に渡されることで HTML と解釈され、埋め込まれたイベントハンドラが発火します。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "公式の対象表：extendthemes / Colibri Page Builder。影響ありとして記載：1.0.390以下の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Colibri Page Builder」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-107758",
"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccae5cbd-cfe6-48b3-8bcd-0b08ceb94680?source=cve",
"https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L68",
"https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L82",
"https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L57",
"https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L205",
"https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L4",
"https://nvd.nist.gov/vuln/detail/CVE-2026-107758"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-107758",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccae5cbd-cfe6-48b3-8bcd-0b08ceb94680?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L68",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L82",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L57",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L205",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L4",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107758",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json",
"sourceField": "/containers/cna/title",
"excerpt": "Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments",
"language": null
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"extendthemes\",\"product\":\"Colibri Page Builder\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.0.390\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-107758（Colibri Page Builder）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Colibri Page Builder プラグインのバージョン 1.0.390 以下はすべて影響を受けます。\n・認証されていない攻撃者がコメントパラメータを通じてスクリプトを注入できます。\n・コメントの許可リストが SVG 要素と任意の data-* 属性を許容しているため、ペイロードが保存されます。\n・colibri.js がフロントエンドの全ページで読み込まれ、保存された data-target 値を jQuery.data() で取得します。\n・取得した値は HTML エンティティがデコードされ、jQuery() に渡されることで HTML と解釈され、埋め込まれたイベントハンドラが発火します。\n・公式の対象表：extendthemes / Colibri Page Builder。影響ありとして記載：1.0.390以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-107758",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:21:09.088Z",
"lastSuccess": "2026-10-23T03:21:09.088Z",
"sourceCheckedAt": "2026-10-23T02:43:42.733Z",
"errorCode": null
},
"glossary": []
}
},
{
"id": "CVE-2026-104769",
"aliases": [],
"title": "Debloat – Remove Unused CSS, Optimize JS：情報の漏えい",
"summary": "Debloat – Remove Unused CSS, Optimize JS プラグインは、's' パラメータを介したディレクトリトラバーサルの脆弱性があります。サイト管理者が Optimize CSS 機能（デフォルトで Inline Google Fonts が有効）を有効にしていると、認証済みの管理者権限以上の攻撃者がサーバー上の任意のファイルを読み取ることが可能になります。この条件が整うと、認証されていない訪問者でも、特別に作成した GET リクエストを公開検索 URL に送るだけで攻撃を実行できます。",
"risk": "任意のファイルを読み取られることで、機密情報が漏洩する可能性があります。",
"product": "Debloat – Remove Unused CSS, Optimize JS",
"category": "wordpress",
"component": "plugin",
"severity": "medium",
"cvss": 5.9,
"cvssVersion": "3.1",
"cvssSource": "Wordfence",
"cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"affected": [
{
"product": "Debloat – Remove Unused CSS, Optimize JS",
"range": "<= 1.3.0"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-104769",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c9b57b-d60d-4197-a9f9-66206518733f?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/CSS.php#L207",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/Minify.php#L218",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L161",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L82",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/optimize-css.php#L221",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/stylesheet.php#L80",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/process.php#L92",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/file-cache.php#L97",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3735830%40debloat&new=3735830%40debloat",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104769",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-10-16T03:38:41.824Z",
"modifiedAt": "2026-10-16T17:17:21.457Z",
"fetchedAt": "2026-10-23T02:43:41.742Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.",
"sourceTitle": "Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed ",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "asadkn",
"product": "Debloat – Remove Unused CSS, Optimize JS",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "1.3.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-104769",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json",
"fetchedAt": "2026-10-23T02:43:41.742Z",
"publishedAt": "2026-10-16T03:38:41.824Z",
"modifiedAt": "2026-10-16T16:18:46.835Z",
"state": "published",
"provider": "Wordfence",
"title": "Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed ",
"descriptions": [
{
"lang": "en",
"value": "The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "asadkn",
"product": "Debloat – Remove Unused CSS, Optimize JS",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThanOrEqual": "1.3.0",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "CWE-22",
"lang": "en",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"provider": "Wordfence",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c9b57b-d60d-4197-a9f9-66206518733f?source=cve",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/0"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/CSS.php#L207",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/1"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/Minify.php#L218",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/2"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L161",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/3"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L82",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/4"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/optimize-css.php#L221",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/5"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/stylesheet.php#L80",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/6"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/process.php#L92",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/7"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/file-cache.php#L97",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/8"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3735830%40debloat&new=3735830%40debloat",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/9"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"asadkn\",\"product\":\"Debloat – Remove Unused CSS, Optimize JS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.3.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"lang\":\"en\",\"description\":\"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\",\"cweId\":\"CWE-22\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1",
"text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-10-16T16:18:46.835Z",
"fetchedAt": "2026-10-23T02:43:41.742Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-16T17:17:21.457Z",
"fetchedAt": "2026-10-22T22:09:15.099Z",
"state": "published"
}
],
"sourceSummary": "Debloat – Remove Unused CSS, Optimize JSに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "本来公開しない情報を読み取られる可能性があります。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:21:09.386Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "396a4a6afe0daaee75f36ebd5764123816ec1694b266075c02fffa5631503438",
"sourceModifiedAt": "2026-10-16T17:17:21.457Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "Debloat – Remove Unused CSS, Optimize JS プラグインは、's' パラメータを介したディレクトリトラバーサルの脆弱性があります。サイト管理者が Optimize CSS 機能（デフォルトで Inline Google Fonts が有効）を有効にしていると、認証済みの管理者権限以上の攻撃者がサーバー上の任意のファイルを読み取ることが可能になります。この条件が整うと、認証されていない訪問者でも、特別に作成した GET リクエストを公開検索 URL に送るだけで攻撃を実行できます。",
"risk": "任意のファイルを読み取られることで、機密情報が漏洩する可能性があります。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E1"
],
"applicability": [
{
"text": "プラグインのバージョンが 1.3.0 以下（1.3.0 を含む）である場合に影響を受けます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json"
],
"evidenceIds": [
"E3",
"E2"
]
},
{
"text": "サイト管理者が Optimize CSS 機能を有効にし、デフォルトの Inline Google Fonts オプションが有効になっている必要があります。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "認証済みで管理者レベル以上の権限を持つ攻撃者が、任意のファイルを読み取ることが可能です。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "上記条件が満たされると、認証されていない訪問者でも単一の GET リクエストで攻撃を実行できます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "公式の対象表：asadkn / Debloat – Remove Unused CSS, Optimize JS。影響ありとして記載：1.3.0以下の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Debloat – Remove Unused CSS, Optimize JS」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-104769",
"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c9b57b-d60d-4197-a9f9-66206518733f?source=cve",
"https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/CSS.php#L207",
"https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/Minify.php#L218",
"https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L161",
"https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L82",
"https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/optimize-css.php#L221",
"https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/stylesheet.php#L80",
"https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/process.php#L92",
"https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/file-cache.php#L97",
"https://plugins.trac.wordpress.org/changeset?reponame=&old=3735830%40debloat&new=3735830%40debloat",
"https://nvd.nist.gov/vuln/detail/CVE-2026-104769"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-104769",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c9b57b-d60d-4197-a9f9-66206518733f?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/CSS.php#L207",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/Minify.php#L218",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L161",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L82",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/optimize-css.php#L221",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/stylesheet.php#L80",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/process.php#L92",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/file-cache.php#L97",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3735830%40debloat&new=3735830%40debloat",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104769",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json",
"sourceField": "/containers/cna/title",
"excerpt": "Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed ",
"language": null
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"asadkn\",\"product\":\"Debloat – Remove Unused CSS, Optimize JS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.3.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-104769（Debloat – Remove Unused CSS, Optimize JS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・プラグインのバージョンが 1.3.0 以下（1.3.0 を含む）である場合に影響を受けます。\n・サイト管理者が Optimize CSS 機能を有効にし、デフォルトの Inline Google Fonts オプションが有効になっている必要があります。\n・認証済みで管理者レベル以上の権限を持つ攻撃者が、任意のファイルを読み取ることが可能です。\n・上記条件が満たされると、認証されていない訪問者でも単一の GET リクエストで攻撃を実行できます。\n・公式の対象表：asadkn / Debloat – Remove Unused CSS, Optimize JS。影響ありとして記載：1.3.0以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-104769",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:21:09.386Z",
"lastSuccess": "2026-10-23T03:21:09.386Z",
"sourceCheckedAt": "2026-10-23T02:43:41.742Z",
"errorCode": null
},
"glossary": []
}
},
{
"id": "CVE-2026-104745",
"aliases": [],
"title": "Customer Email Verification for WooCommerce：権限の奪取",
"summary": "Customer Email Verification for WooCommerce プラグイン（バージョン 3.3.0 以下）において、`alg_wc_ev_verify_email` パラメータを介した特権昇格の脆弱性があります。プラグインの「Encoding method」設定がデフォルト以外の「hashids」に設定されていると、攻撃者は認証されていない状態で任意の未確認 WordPress アカウント（管理者アカウントを含む）に対して認証を取得できる可能性があります。",
"risk": "認証されていない攻撃者が、未確認の WordPress アカウント（管理者レベルを含む）としてログインできるようになる可能性があります。",
"product": "Customer Email Verification for WooCommerce",
"category": "wordpress",
"component": "plugin",
"severity": "high",
"cvss": 8.1,
"cvssVersion": "3.1",
"cvssSource": "Wordfence",
"cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"affected": [
{
"product": "Customer Email Verification for WooCommerce",
"range": "<= 3.3.0"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-104745",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6df7b3ed-a1e3-4df9-828e-95530661e27a?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/alg-wc-ev-functions.php#L331",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L784",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L498",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L1258",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3744623%40emails-verification-for-woocommerce&new=3744623%40emails-verification-for-woocommerce",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104745",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-10-16T03:38:41.491Z",
"modifiedAt": "2026-10-16T15:17:03.563Z",
"fetchedAt": "2026-10-23T02:43:41.722Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.",
"sourceTitle": "Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "wpcodefactory",
"product": "Customer Email Verification for WooCommerce",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "3.3.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-104745",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json",
"fetchedAt": "2026-10-23T02:43:41.722Z",
"publishedAt": "2026-10-16T03:38:41.491Z",
"modifiedAt": "2026-10-16T15:09:41.042Z",
"state": "published",
"provider": "Wordfence",
"title": "Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter",
"descriptions": [
{
"lang": "en",
"value": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "wpcodefactory",
"product": "Customer Email Verification for WooCommerce",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThanOrEqual": "3.3.0",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "CWE-269",
"lang": "en",
"description": "CWE-269 Improper Privilege Management",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"provider": "Wordfence",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6df7b3ed-a1e3-4df9-828e-95530661e27a?source=cve",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/0"
},
{
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/alg-wc-ev-functions.php#L331",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/1"
},
{
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L784",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/2"
},
{
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L498",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/3"
},
{
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L1258",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/4"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3744623%40emails-verification-for-woocommerce&new=3744623%40emails-verification-for-woocommerce",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/5"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"wpcodefactory\",\"product\":\"Customer Email Verification for WooCommerce\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.3.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"lang\":\"en\",\"description\":\"CWE-269 Improper Privilege Management\",\"cweId\":\"CWE-269\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1",
"text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-10-16T15:09:41.042Z",
"fetchedAt": "2026-10-23T02:43:41.722Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-16T15:17:03.563Z",
"fetchedAt": "2026-10-22T22:09:15.099Z",
"state": "published"
}
],
"sourceSummary": "Customer Email Verification for WooCommerceに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "本来与えられていない権限で、操作される可能性があります。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:21:09.622Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "8c7fa9f690933092deb708381554a63288d66f65f90b8010c4207e3082b93224",
"sourceModifiedAt": "2026-10-16T15:17:03.563Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "Customer Email Verification for WooCommerce プラグイン（バージョン 3.3.0 以下）において、`alg_wc_ev_verify_email` パラメータを介した特権昇格の脆弱性があります。プラグインの「Encoding method」設定がデフォルト以外の「hashids」に設定されていると、攻撃者は認証されていない状態で任意の未確認 WordPress アカウント（管理者アカウントを含む）に対して認証を取得できる可能性があります。",
"risk": "認証されていない攻撃者が、未確認の WordPress アカウント（管理者レベルを含む）としてログインできるようになる可能性があります。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E2"
],
"applicability": [
{
"text": "対象プラグインは Customer Email Verification for WooCommerce である。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E3",
"E1"
]
},
{
"text": "影響を受けるバージョンは 3.3.0 以下（3.3.0 を含む）である。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E3",
"E1"
]
},
{
"text": "プラグインの設定項目「Encoding method」が「hashids」に設定されていることが必要条件である。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "「hashids」設定はデフォルトではなく、管理者が手動で変更した場合にのみ適用される。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "`alg_wc_ev_generate_user_code()` が `wp_rand(100)` を用いて 0〜100 の 101 通りしかないコードを生成する。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "生成されたトークンは可逆的な Hashids エンコードであり、暗号的な MAC が付与されていない。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "`verify()` ハンドラは `init` フックの PHP_INT_MAX で実行され、nonce チェックやレートリミットが設定されていない。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "攻撃者は GET パラメータ `?alg_wc_ev_verify_email=` を任意に設定でき、ハンドラはこのパラメータを直接処理する。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "攻撃者は非常に小さなコード空間（約 101 通り）を総当たりで試行できるため、認証コードを brute‑force できる。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "対象アカウントのメールアドレスが未確認（未検証）のままであることが必要である。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "Hashids の salt がデフォルトで `md5(time())` として初回初期化時に設定されるため、攻撃者がこの salt を取得または推測できる必要がある。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "公式の対象表：wpcodefactory / Customer Email Verification for WooCommerce。影響ありとして記載：3.3.0以下の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Customer Email Verification for WooCommerce」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-104745",
"https://www.wordfence.com/threat-intel/vulnerabilities/id/6df7b3ed-a1e3-4df9-828e-95530661e27a?source=cve",
"https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/alg-wc-ev-functions.php#L331",
"https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L784",
"https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L498",
"https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L1258",
"https://plugins.trac.wordpress.org/changeset?reponame=&old=3744623%40emails-verification-for-woocommerce&new=3744623%40emails-verification-for-woocommerce",
"https://nvd.nist.gov/vuln/detail/CVE-2026-104745"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-104745",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6df7b3ed-a1e3-4df9-828e-95530661e27a?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/alg-wc-ev-functions.php#L331",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L784",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L498",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L1258",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3744623%40emails-verification-for-woocommerce&new=3744623%40emails-verification-for-woocommerce",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104745",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json",
"sourceField": "/containers/cna/title",
"excerpt": "Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter",
"language": null
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"wpcodefactory\",\"product\":\"Customer Email Verification for WooCommerce\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.3.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-104745（Customer Email Verification for WooCommerce）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインは Customer Email Verification for WooCommerce である。\n・影響を受けるバージョンは 3.3.0 以下（3.3.0 を含む）である。\n・プラグインの設定項目「Encoding method」が「hashids」に設定されていることが必要条件である。\n・「hashids」設定はデフォルトではなく、管理者が手動で変更した場合にのみ適用される。\n・`alg_wc_ev_generate_user_code()` が `wp_rand(100)` を用いて 0〜100 の 101 通りしかないコードを生成する。\n・生成されたトークンは可逆的な Hashids エンコードであり、暗号的な MAC が付与されていない。\n・`verify()` ハンドラは `init` フックの PHP_INT_MAX で実行され、nonce チェックやレートリミットが設定されていない。\n・攻撃者は GET パラメータ `?alg_wc_ev_verify_email=` を任意に設定でき、ハンドラはこのパラメータを直接処理する。\n・攻撃者は非常に小さなコード空間（約 101 通り）を総当たりで試行できるため、認証コードを brute‑force できる。\n・対象アカウントのメールアドレスが未確認（未検証）のままであることが必要である。\n・Hashids の salt がデフォルトで `md5(time())` として初回初期化時に設定されるため、攻撃者がこの salt を取得または推測できる必要がある。\n・公式の対象表：wpcodefactory / Customer Email Verification for WooCommerce。影響ありとして記載：3.3.0以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-104745",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:21:09.622Z",
"lastSuccess": "2026-10-23T03:21:09.622Z",
"sourceCheckedAt": "2026-10-23T02:43:41.722Z",
"errorCode": null
},
"glossary": [
{
"term": "WordPressのnonce",
"meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。",
"sourceUrl": "https://developer.wordpress.org/apis/security/nonces/",
"kind": "general_definition"
}
]
}
},
{
"id": "CVE-2026-103518",
"aliases": [],
"title": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler：データベースへの不正操作",
"summary": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler プラグインは、'products[*].variants[*].<攻撃者が選択したキー>' パラメータに対するエスケープ処理が不十分で、既存の SQL クエリの準備も不十分なため、すべてのバージョン（1.7.0 まで）で汎用的な SQL インジェクションが可能です。この脆弱性により、認証済みで custom‑level 以上の権限を持つ攻撃者は、既存のクエリに追加の SQL 文を組み込んでデータベースから機密情報を取得できるようになります。FluentCart Pro のインストールでは、管理者権限でなくても Manager ショップロールが付与されたユーザーが products/edit 権限を持つため、同様にこの脆弱性を悪用できます。",
"risk": "攻撃者はデータベースに対して任意の SQL クエリを実行できるため、機密情報が漏洩する恐れがあります。",
"product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler",
"category": "wordpress",
"component": "plugin",
"severity": "medium",
"cvss": 4.9,
"cvssVersion": "3.1",
"cvssSource": "Wordfence",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"affected": [
{
"product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler",
"range": "<= 1.7.0"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-103518",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/094a768d-85f8-4b6a-8aa3-e243f2e4b505?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/BatchQuery/Batch.php#L103",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Http/Controllers/ProductController.php#L1818",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Services/BulkProductUpdateService.php#L413",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Resource/ProductResource.php#L304",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/Concerns/CanUpdateBatch.php#L14",
"label": "security@wordfence.com"
},
{
"url": "https://wordpress.org/plugins/fluent-cart/",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3734886/fluent-cart/trunk/app/Models/BatchQuery/Batch.php",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103518",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-10-16T03:38:40.123Z",
"modifiedAt": "2026-10-16T15:17:02.147Z",
"fetchedAt": "2026-10-23T02:43:41.141Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.",
"sourceTitle": "FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "wpmanageninja",
"product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "1.7.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-103518",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json",
"fetchedAt": "2026-10-23T02:43:41.141Z",
"publishedAt": "2026-10-16T03:38:40.123Z",
"modifiedAt": "2026-10-16T15:09:41.350Z",
"state": "published",
"provider": "Wordfence",
"title": "FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys",
"descriptions": [
{
"lang": "en",
"value": "The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "wpmanageninja",
"product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThanOrEqual": "1.7.0",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "CWE-89",
"lang": "en",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"provider": "Wordfence",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/094a768d-85f8-4b6a-8aa3-e243f2e4b505?source=cve",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/0"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/BatchQuery/Batch.php#L103",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/1"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Http/Controllers/ProductController.php#L1818",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/2"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Services/BulkProductUpdateService.php#L413",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/3"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Resource/ProductResource.php#L304",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/4"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/Concerns/CanUpdateBatch.php#L14",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/5"
},
{
"url": "https://wordpress.org/plugins/fluent-cart/",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/6"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3734886/fluent-cart/trunk/app/Models/BatchQuery/Batch.php",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/7"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"wpmanageninja\",\"product\":\"FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.7.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"lang\":\"en\",\"description\":\"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\",\"cweId\":\"CWE-89\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1",
"text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-10-16T15:09:41.350Z",
"fetchedAt": "2026-10-23T02:43:41.141Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-16T15:17:02.147Z",
"fetchedAt": "2026-10-22T22:09:15.099Z",
"state": "published"
}
],
"sourceSummary": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simplerにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:21:09.640Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "134f21c484bb15d54948ccd3f8d746a1f6cf5d01bc3cb616ab7ecade177b9d22",
"sourceModifiedAt": "2026-10-16T15:17:02.147Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler プラグインは、'products[*].variants[*].<攻撃者が選択したキー>' パラメータに対するエスケープ処理が不十分で、既存の SQL クエリの準備も不十分なため、すべてのバージョン（1.7.0 まで）で汎用的な SQL インジェクションが可能です。この脆弱性により、認証済みで custom‑level 以上の権限を持つ攻撃者は、既存のクエリに追加の SQL 文を組み込んでデータベースから機密情報を取得できるようになります。FluentCart Pro のインストールでは、管理者権限でなくても Manager ショップロールが付与されたユーザーが products/edit 権限を持つため、同様にこの脆弱性を悪用できます。",
"risk": "攻撃者はデータベースに対して任意の SQL クエリを実行できるため、機密情報が漏洩する恐れがあります。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E1"
],
"applicability": [
{
"text": "バージョン 1.7.0 まで（それを含む）のすべてのリリースが影響を受けます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json"
],
"evidenceIds": [
"E3",
"E2"
]
},
{
"text": "認証済みで custom‑level 以上の権限を持つ攻撃者がこの脆弱性を利用できます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "FluentCart Pro 環境では、Manager ショップロールが付与された非管理者ユーザーも products/edit 権限を持ち、同様に脆弱性を悪用できます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "公式の対象表：wpmanageninja / FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler。影響ありとして記載：1.7.0以下の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-103518",
"https://www.wordfence.com/threat-intel/vulnerabilities/id/094a768d-85f8-4b6a-8aa3-e243f2e4b505?source=cve",
"https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/BatchQuery/Batch.php#L103",
"https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Http/Controllers/ProductController.php#L1818",
"https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Services/BulkProductUpdateService.php#L413",
"https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Resource/ProductResource.php#L304",
"https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/Concerns/CanUpdateBatch.php#L14",
"https://wordpress.org/plugins/fluent-cart/",
"https://plugins.trac.wordpress.org/changeset/3734886/fluent-cart/trunk/app/Models/BatchQuery/Batch.php",
"https://nvd.nist.gov/vuln/detail/CVE-2026-103518"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-103518",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/094a768d-85f8-4b6a-8aa3-e243f2e4b505?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/BatchQuery/Batch.php#L103",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Http/Controllers/ProductController.php#L1818",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Services/BulkProductUpdateService.php#L413",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Resource/ProductResource.php#L304",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/Concerns/CanUpdateBatch.php#L14",
"label": "security@wordfence.com"
},
{
"url": "https://wordpress.org/plugins/fluent-cart/",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3734886/fluent-cart/trunk/app/Models/BatchQuery/Batch.php",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103518",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json",
"sourceField": "/containers/cna/title",
"excerpt": "FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys",
"language": null
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"wpmanageninja\",\"product\":\"FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.7.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-103518（FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・バージョン 1.7.0 まで（それを含む）のすべてのリリースが影響を受けます。\n・認証済みで custom‑level 以上の権限を持つ攻撃者がこの脆弱性を利用できます。\n・FluentCart Pro 環境では、Manager ショップロールが付与された非管理者ユーザーも products/edit 権限を持ち、同様に脆弱性を悪用できます。\n・公式の対象表：wpmanageninja / FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler。影響ありとして記載：1.7.0以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-103518",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:21:09.640Z",
"lastSuccess": "2026-10-23T03:21:09.640Z",
"sourceCheckedAt": "2026-10-23T02:43:41.141Z",
"errorCode": null
},
"glossary": [
{
"term": "SQLインジェクション",
"meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。",
"sourceUrl": "https://cwe.mitre.org/data/definitions/89.html",
"kind": "general_definition"
}
]
}
},
{
"id": "CVE-2026-100159",
"aliases": [],
"title": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popups：脆弱性情報",
"summary": "Popup Box プラグイン（バージョン 6.4.1 から 6.4.2）では、未認証の攻撃者が Client-IP や X-Forwarded-For などのリクエストヘッダーを操作し、管理者がポップアップのカスタムコンテンツに %%user_ip_address%% トークンを入れていると、任意のショートコードをサーバー上で実行できる脆弱性があります。",
"risk": "攻撃者が任意のショートコードを実行できるため、サーバー上の任意のデータを取得したり、サイトにインストールされている他のショートコードが提供する機能を悪用される可能性があります。",
"product": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popups",
"category": "wordpress",
"component": "plugin",
"severity": "medium",
"cvss": 4.8,
"cvssVersion": "3.1",
"cvssSource": "Wordfence",
"cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"affected": [
{
"product": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popups",
"range": ">= 6.4.1 / <= 6.4.2"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100159",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/class-ays-pb-public.php#L3389",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4560",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4299",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/includes/class-ays-pb-data.php#L79",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L69",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.3/public/class-ays-pb-public.php",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100159",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-10-16T02:26:09.256Z",
"modifiedAt": "2026-10-16T15:16:58.060Z",
"fetchedAt": "2026-10-23T02:43:40.743Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.",
"sourceTitle": "Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "ays-pro",
"product": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popups",
"versions": [
{
"version": "6.4.1",
"status": "affected",
"lessThanOrEqual": "6.4.2",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-100159",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json",
"fetchedAt": "2026-10-23T02:43:40.743Z",
"publishedAt": "2026-10-16T02:26:09.256Z",
"modifiedAt": "2026-10-16T15:09:41.509Z",
"state": "published",
"provider": "Wordfence",
"title": "Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers",
"descriptions": [
{
"lang": "en",
"value": "The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "ays-pro",
"product": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popups",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "6.4.1",
"lessThanOrEqual": "6.4.2",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "CWE-94",
"lang": "en",
"description": "CWE-94 Improper Control of Generation of Code ('Code Injection')",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"provider": "Wordfence",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=cve",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/0"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/class-ays-pb-public.php#L3389",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/1"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4560",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/2"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4299",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/3"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/includes/class-ays-pb-data.php#L79",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/4"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L69",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/5"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.3/public/class-ays-pb-public.php",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/6"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"ays-pro\",\"product\":\"Popup Box – Create Countdown, Coupon, Video, Contact Form Popups\",\"versions\":[{\"version\":\"6.4.1\",\"status\":\"affected\",\"lessThanOrEqual\":\"6.4.2\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"lang\":\"en\",\"description\":\"CWE-94 Improper Control of Generation of Code ('Code Injection')\",\"cweId\":\"CWE-94\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1",
"text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-10-16T15:09:41.509Z",
"fetchedAt": "2026-10-23T02:43:40.743Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-16T15:16:58.060Z",
"fetchedAt": "2026-10-22T22:09:15.099Z",
"state": "published"
}
],
"sourceSummary": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popupsに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:21:10.662Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "0858d8ab3263b9f8d97ac0f64fb9b19e17094fb92062d438b39e99ec02b336e0",
"sourceModifiedAt": "2026-10-16T15:16:58.060Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "Popup Box プラグイン（バージョン 6.4.1 から 6.4.2）では、未認証の攻撃者が Client-IP や X-Forwarded-For などのリクエストヘッダーを操作し、管理者がポップアップのカスタムコンテンツに %%user_ip_address%% トークンを入れていると、任意のショートコードをサーバー上で実行できる脆弱性があります。",
"risk": "攻撃者が任意のショートコードを実行できるため、サーバー上の任意のデータを取得したり、サイトにインストールされている他のショートコードが提供する機能を悪用される可能性があります。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E1"
],
"applicability": [
{
"text": "未認証の攻撃者が Client-IP、X-Forwarded-For、Forwarded、X-Forwarded、Forwarded-For ヘッダーを操作できる。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "プラグインの ays_popup_get_user_ip() 関数がこれらヘッダーを sanitize_text_field() だけでサニタイズする。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "ポップアップのカスタムコンテンツ本文に %%user_ip_address%% トークンが含まれている。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "Ays_Pb_Data::replace_message_variables() がトークンを生の文字列置換で置き換え、エスケープせずに do_shortcode() に渡す。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "対象プラグインのバージョンが 6.4.1 以上 6.4.2 以下である。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json"
],
"evidenceIds": [
"E3",
"E2"
]
},
{
"text": "管理者がポップアップに上記トークンを追加している。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "公式の対象表：ays-pro / Popup Box – Create Countdown, Coupon, Video, Contact Form Popups。影響ありとして記載：6.4.1以上、6.4.2以下。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Popup Box – Create Countdown, Coupon, Video, Contact Form Popups」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-100159",
"https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=cve",
"https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/class-ays-pb-public.php#L3389",
"https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4560",
"https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4299",
"https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/includes/class-ays-pb-data.php#L79",
"https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L69",
"https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.3/public/class-ays-pb-public.php",
"https://nvd.nist.gov/vuln/detail/CVE-2026-100159"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100159",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/class-ays-pb-public.php#L3389",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4560",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4299",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/includes/class-ays-pb-data.php#L79",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L69",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.3/public/class-ays-pb-public.php",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100159",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json",
"sourceField": "/containers/cna/title",
"excerpt": "Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers",
"language": null
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"ays-pro\",\"product\":\"Popup Box – Create Countdown, Coupon, Video, Contact Form Popups\",\"versions\":[{\"version\":\"6.4.1\",\"status\":\"affected\",\"lessThanOrEqual\":\"6.4.2\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-100159（Popup Box – Create Countdown, Coupon, Video, Contact Form Popups）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・未認証の攻撃者が Client-IP、X-Forwarded-For、Forwarded、X-Forwarded、Forwarded-For ヘッダーを操作できる。\n・プラグインの ays_popup_get_user_ip() 関数がこれらヘッダーを sanitize_text_field() だけでサニタイズする。\n・ポップアップのカスタムコンテンツ本文に %%user_ip_address%% トークンが含まれている。\n・Ays_Pb_Data::replace_message_variables() がトークンを生の文字列置換で置き換え、エスケープせずに do_shortcode() に渡す。\n・対象プラグインのバージョンが 6.4.1 以上 6.4.2 以下である。\n・管理者がポップアップに上記トークンを追加している。\n・公式の対象表：ays-pro / Popup Box – Create Countdown, Coupon, Video, Contact Form Popups。影響ありとして記載：6.4.1以上、6.4.2以下。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-100159",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:21:10.662Z",
"lastSuccess": "2026-10-23T03:21:10.662Z",
"sourceCheckedAt": "2026-10-23T02:43:40.743Z",
"errorCode": null
},
"glossary": []
}
},
{
"id": "CVE-2026-96563",
"aliases": [],
"title": "Motors – Car Dealership & Classified Listings Plugin：ブラウザー上での不正な処理",
"summary": "Motors プラグイン（バージョン 1.4.124 以下）において、'stm_f_s' パラメータが十分にサニタイズ・エスケープされていないため、認証済みの Subscriber 以上のユーザーが任意のウェブスクリプトをページに埋め込むことができ、ページを閲覧したユーザーのブラウザーでそのスクリプトが実行されます。また、stm_ajax_add_a_car AJAX ハンドラで必要な nonce が wp_footer で全ページに出力されるため、認証ユーザーは容易に取得でき、Subscriber 権限だけでも実行可能です。",
"risk": "ページを表示した人のブラウザーで不正な処理が実行される可能性があります。",
"product": "Motors – Car Dealership & Classified Listings Plugin",
"category": "wordpress",
"component": "plugin",
"severity": "medium",
"cvss": 6.4,
"cvssVersion": "3.1",
"cvssSource": "Wordfence",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"affected": [
{
"product": "Motors – Car Dealership & Classified Listings Plugin",
"range": "<= 1.4.124"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96563",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/14bb850e-df8a-46f0-b320-d8aedd763901?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/init.js#L311",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/init.js#L337",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/filter.js#L724",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/filter.js#L751",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/includes/vehicle_functions.php#L1432",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/includes/vehicle_functions.php#L1199",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3728105/",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96563",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-10-10T07:41:42.772Z",
"modifiedAt": "2026-10-22T20:17:08.220Z",
"fetchedAt": "2026-10-23T02:43:53.365Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and removing any practical barrier to exploitation at the Subscriber level.",
"sourceTitle": "Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "stylemix",
"product": "Motors – Car Dealership & Classified Listings Plugin",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "1.4.124",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-96563",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json",
"fetchedAt": "2026-10-23T02:43:53.365Z",
"publishedAt": "2026-10-10T07:41:42.772Z",
"modifiedAt": "2026-10-22T19:43:54.466Z",
"state": "published",
"provider": "Wordfence",
"title": "Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter",
"descriptions": [
{
"lang": "en",
"value": "The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and removing any practical barrier to exploitation at the Subscriber level.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "stylemix",
"product": "Motors – Car Dealership & Classified Listings Plugin",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThanOrEqual": "1.4.124",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "CWE-79",
"lang": "en",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"provider": "Wordfence",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/14bb850e-df8a-46f0-b320-d8aedd763901?source=cve",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/0"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/init.js#L311",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/1"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/init.js#L337",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/2"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/filter.js#L724",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/3"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/filter.js#L751",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/4"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/includes/vehicle_functions.php#L1432",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/5"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/includes/vehicle_functions.php#L1199",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/6"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3728105/",
"label": "Wordfence",
"tags": [],
"provider": "Wordfence",
"sourcePath": "/containers/cna/references/7"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"stylemix\",\"product\":\"Motors – Car Dealership & Classified Listings Plugin\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.4.124\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and removing any practical barrier to exploitation at the Subscriber level.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json",
"sourcePath": "/containers/cna/metrics/0/cvssV3_1",
"text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":6.4,\"baseSeverity\":\"MEDIUM\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-10-22T19:43:54.466Z",
"fetchedAt": "2026-10-23T02:43:53.365Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-22T20:17:08.220Z",
"fetchedAt": "2026-10-22T22:09:42.384Z",
"state": "published"
}
],
"sourceSummary": "Motors – Car Dealership & Classified Listings Pluginにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:21:21.221Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "3f0a488b0284c56a1fd258dd8501daeab6d7a269ac7e55d0482d390714c1af56",
"sourceModifiedAt": "2026-10-22T20:17:08.220Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "Motors プラグイン（バージョン 1.4.124 以下）において、'stm_f_s' パラメータが十分にサニタイズ・エスケープされていないため、認証済みの Subscriber 以上のユーザーが任意のウェブスクリプトをページに埋め込むことができ、ページを閲覧したユーザーのブラウザーでそのスクリプトが実行されます。また、stm_ajax_add_a_car AJAX ハンドラで必要な nonce が wp_footer で全ページに出力されるため、認証ユーザーは容易に取得でき、Subscriber 権限だけでも実行可能です。",
"risk": "ページを表示した人のブラウザーで不正な処理が実行される可能性があります。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E2"
],
"applicability": [
{
"text": "Motors – Car Dealership & Classified Listings Plugin のバージョン 1.4.124 以下すべてが影響を受けます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json"
],
"evidenceIds": [
"E3",
"E1"
]
},
{
"text": "Subscriber 以上の権限を持つ認証済みユーザーが攻撃を実行できます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "stm_ajax_add_a_car AJAX ハンドラで必要な nonce が wp_footer で全ページに出力され、認証ユーザーが取得できるため、実質的な障壁がありません。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "公式の対象表：stylemix / Motors – Car Dealership & Classified Listings Plugin。影響ありとして記載：1.4.124以下の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Motors – Car Dealership & Classified Listings Plugin」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-96563",
"https://www.wordfence.com/threat-intel/vulnerabilities/id/14bb850e-df8a-46f0-b320-d8aedd763901?source=cve",
"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/init.js#L311",
"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/init.js#L337",
"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/filter.js#L724",
"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/filter.js#L751",
"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/includes/vehicle_functions.php#L1432",
"https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/includes/vehicle_functions.php#L1199",
"https://plugins.trac.wordpress.org/changeset/3728105/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-96563"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json",
"label": "CVE：Wordfence"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96563",
"label": "CVE公式レコード"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/14bb850e-df8a-46f0-b320-d8aedd763901?source=cve",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/init.js#L311",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/init.js#L337",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/filter.js#L724",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/assets/js/frontend/filter.js#L751",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/includes/vehicle_functions.php#L1432",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.123/includes/vehicle_functions.php#L1199",
"label": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3728105/",
"label": "security@wordfence.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96563",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json",
"sourceField": "/containers/cna/title",
"excerpt": "Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter",
"language": null
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and removing any practical barrier to exploitation at the Subscriber level.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96563.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"stylemix\",\"product\":\"Motors – Car Dealership & Classified Listings Plugin\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.4.124\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-96563（Motors – Car Dealership & Classified Listings Plugin）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Motors – Car Dealership & Classified Listings Plugin のバージョン 1.4.124 以下すべてが影響を受けます。\n・Subscriber 以上の権限を持つ認証済みユーザーが攻撃を実行できます。\n・stm_ajax_add_a_car AJAX ハンドラで必要な nonce が wp_footer で全ページに出力され、認証ユーザーが取得できるため、実質的な障壁がありません。\n・公式の対象表：stylemix / Motors – Car Dealership & Classified Listings Plugin。影響ありとして記載：1.4.124以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-96563",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:21:21.221Z",
"lastSuccess": "2026-10-23T03:21:21.221Z",
"sourceCheckedAt": "2026-10-23T02:43:53.365Z",
"errorCode": null
},
"glossary": [
{
"term": "WordPressのnonce",
"meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。",
"sourceUrl": "https://developer.wordpress.org/apis/security/nonces/",
"kind": "general_definition"
}
]
}
},
{
"id": "CVE-2026-87902",
"aliases": [],
"title": "WordPress：コード実行",
"summary": "認証されていない攻撃者が `get_page_template()` のページテンプレート解決時に、アクティブテーマディレクトリ外にある任意の読み取り可能な .php ファイルを読み込ませることができ、サーバーや機器に攻撃者の命令を実行させられる可能性があります。",
"risk": "この脆弱性が利用されると、サーバーや機器に攻撃者の命令を実行させられる（リモートコード実行）可能性があります。",
"product": "WordPress",
"category": "wordpress",
"component": "core",
"severity": "unknown",
"cvss": null,
"cvssVersion": null,
"cvssSource": "hackerone",
"cvssVector": null,
"affected": [
{
"product": "WordPress",
"range": "< 7.1.2"
}
],
"fixed": [],
"steps": [
"WordPress 7.1.2 がリリースされており、本脆弱性の修正が含まれています。また、古いブランチでも 4.7 まで遡って修正がバックポートされています。",
"「CVE-2026-87902」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。",
"ファイルとデータベースのバックアップを取り、管理画面の「ダッシュボード」→「更新」でWordPress本体の更新を実行します。更新が表示されない有料製品などは、購入先・開発元の正規の配布経路を利用してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json",
"label": "CVE：hackerone"
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902",
"label": "CISA KEV（悪用確認）"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87902",
"label": "CVE公式レコード"
},
{
"url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp",
"label": "CISAが示す関連情報"
},
{
"url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk",
"label": "CISAが示す関連情報"
},
{
"url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk",
"label": "CISAが示す関連情報"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87902",
"label": "CISAが示す関連情報"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-09-22T16:44:15.048Z",
"modifiedAt": "2026-09-26T03:55:51.560Z",
"fetchedAt": "2026-10-23T02:43:51.770Z",
"exploitStatus": "confirmed",
"sources": [
"CVE",
"CISA KEV"
],
"originalText": "An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.",
"sourceTitle": "",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"defaultStatus": "unaffected",
"vendor": "WordPress",
"product": "WordPress",
"versions": [
{
"version": "0",
"status": "affected",
"lessThan": "7.1.2",
"versionType": "semver"
}
]
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-87902",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json",
"fetchedAt": "2026-10-23T02:43:51.770Z",
"publishedAt": "2026-09-22T16:44:15.048Z",
"modifiedAt": "2026-09-26T03:55:51.560Z",
"state": "published",
"provider": "hackerone",
"title": "",
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "WordPress",
"product": "WordPress",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThan": "7.1.2",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [
{
"lang": "en",
"value": "WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.",
"sourcePath": "/containers/cna/workarounds/0/value"
}
],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "CWE-98",
"lang": "en",
"description": "CWE-98 Remote File Inclusion",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp",
"label": "hackerone",
"tags": [],
"provider": "hackerone",
"sourcePath": "/containers/cna/references/0"
},
{
"url": "https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/",
"label": "CISA-ADP",
"tags": [
"third-party-advisory"
],
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/references/0"
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902",
"label": "CISA-ADP",
"tags": [
"government-resource"
],
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/references/1"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"defaultStatus\":\"unaffected\",\"vendor\":\"WordPress\",\"product\":\"WordPress\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"7.1.2\",\"versionType\":\"semver\"}]}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/workarounds/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json",
"sourcePath": "/containers/cna/workarounds/0/value",
"text": "WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"type\":\"CWE\",\"lang\":\"en\",\"cweId\":\"CWE-98\",\"description\":\"CWE-98 Remote File Inclusion\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1",
"text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.1,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-09-26T03:55:51.560Z",
"fetchedAt": "2026-10-23T02:43:51.770Z",
"state": "published"
},
{
"source": "CISA KEV",
"modifiedAt": "2026-09-25T00:00:00.000Z",
"fetchedAt": "2026-10-23T02:17:50.489Z",
"state": "published"
}
],
"sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"sourceSummary": "WordPressにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:21:36.680Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "a407be472afbe52b52136a4696a78da9e2cf33b4bb3d74f40643cfc40a7a0cbb",
"sourceModifiedAt": "2026-09-26T03:55:51.560Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "認証されていない攻撃者が `get_page_template()` のページテンプレート解決時に、アクティブテーマディレクトリ外にある任意の読み取り可能な .php ファイルを読み込ませることができ、サーバーや機器に攻撃者の命令を実行させられる可能性があります。",
"risk": "この脆弱性が利用されると、サーバーや機器に攻撃者の命令を実行させられる（リモートコード実行）可能性があります。",
"summaryEvidenceIds": [
"E1"
],
"riskEvidenceIds": [
"E1"
],
"applicability": [
{
"text": "認証されていない攻撃者が対象となります。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json"
],
"evidenceIds": [
"E1"
]
},
{
"text": "`get_page_template()` 関数がページテンプレートの解決に使用される必要があります。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json"
],
"evidenceIds": [
"E1"
]
},
{
"text": "攻撃者が読み取り可能なローカルの .php ファイルを、アクティブテーマディレクトリ外に配置できることが前提です。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json"
],
"evidenceIds": [
"E1"
]
},
{
"text": "サーバーとアクティブテーマの両方が、脆弱性を引き起こす特定の前提条件を満たしている必要があります。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json"
],
"evidenceIds": [
"E1"
]
},
{
"text": "公式の対象表：WordPress / WordPress。影響ありとして記載：7.1.2未満の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json"
],
"evidenceIds": [
"E2"
]
},
{
"text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。",
"kind": "fact",
"sourceUrls": [
"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902"
],
"evidenceIds": [
"E4"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json"
],
"evidenceIds": [
"E2"
]
},
{
"text": "WordPressの管理画面で「ツール」→「サイトヘルス」→「情報」→「WordPress」を開き、本体のバージョンを控えます。プラグインやPHPの番号とは別です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "WordPress 7.1.2 がリリースされており、本脆弱性の修正が含まれています。また、古いブランチでも 4.7 まで遡って修正がバックポートされています。",
"kind": "fix",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "「CVE-2026-87902」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://www.cve.org/CVERecord?id=CVE-2026-87902",
"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp",
"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902",
"https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk",
"https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk",
"https://nvd.nist.gov/vuln/detail/CVE-2026-87902"
]
},
{
"text": "ファイルとデータベースのバックアップを取り、管理画面の「ダッシュボード」→「更新」でWordPress本体の更新を実行します。更新が表示されない有料製品などは、購入先・開発元の正規の配布経路を利用してください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/",
"https://wordpress.org/documentation/article/manage-plugins/"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-87902",
"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp",
"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902",
"https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk",
"https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk",
"https://nvd.nist.gov/vuln/detail/CVE-2026-87902"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json"
],
"evidenceIds": [
"E2"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json",
"label": "CVE：hackerone"
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902",
"label": "CISA KEV（悪用確認）"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87902",
"label": "CVE公式レコード"
},
{
"url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp",
"label": "CISAが示す関連情報"
},
{
"url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk",
"label": "CISAが示す関連情報"
},
{
"url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk",
"label": "CISAが示す関連情報"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87902",
"label": "CISAが示す関連情報"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"defaultStatus\":\"unaffected\",\"vendor\":\"WordPress\",\"product\":\"WordPress\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"7.1.2\",\"versionType\":\"semver\"}]}",
"language": null,
"representation": "source_json"
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json",
"sourceField": "/containers/cna/workarounds/0/value",
"excerpt": "WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E4",
"sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902",
"sourceField": "/exploitStatus",
"excerpt": "{\"id\":\"CVE-2026-87902\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}",
"language": "en",
"representation": "normalized_feed_field"
}
],
"supportRequest": "件名：CVE-2026-87902（WordPress）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていない攻撃者が対象となります。\n・`get_page_template()` 関数がページテンプレートの解決に使用される必要があります。\n・攻撃者が読み取り可能なローカルの .php ファイルを、アクティブテーマディレクトリ外に配置できることが前提です。\n・サーバーとアクティブテーマの両方が、脆弱性を引き起こす特定の前提条件を満たしている必要があります。\n・公式の対象表：WordPress / WordPress。影響ありとして記載：7.1.2未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-87902",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:21:36.680Z",
"lastSuccess": "2026-10-23T03:21:36.680Z",
"sourceCheckedAt": "2026-10-23T02:43:51.770Z",
"errorCode": null
},
"glossary": [
{
"term": "任意のコード実行",
"meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。",
"sourceUrl": "https://cwe.mitre.org/data/definitions/94.html",
"kind": "general_definition"
}
]
}
},
{
"id": "CVE-2026-19709",
"aliases": [],
"title": "Membership For WooCommerce：脆弱性情報",
"summary": "Membership For WooCommerce プラグインはバージョン 3.1.2 未満において、API コンシューマーシークレットが実際に生成されているかを確認せず、リクエストに含まれるシークレットとだけ比較します。そのため、認証されていない攻撃者が REST エンドポイントにアクセスでき、API が有効化されているがキーが一度も生成されていないサイトで、任意のユーザーの会員プラン詳細を取得できます。",
"risk": "任意のユーザーの会員プランの詳細が外部に漏洩する可能性があります。",
"product": "Membership For WooCommerce",
"category": "wordpress",
"component": "plugin",
"severity": "medium",
"cvss": 5.3,
"cvssVersion": "3.1",
"cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"affected": [
{
"product": "Membership For WooCommerce",
"range": "< 3.1.2"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19709",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/957888a4-bb11-42c6-930a-8c836170452b/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19709",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-08-19T06:00:21.457Z",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-23T02:43:47.061Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.",
"sourceTitle": "Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "Unknown",
"product": "Membership For WooCommerce",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "3.1.2"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-19709",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json",
"fetchedAt": "2026-10-23T02:43:47.061Z",
"publishedAt": "2026-08-19T06:00:21.457Z",
"modifiedAt": "2026-08-19T16:38:02.711Z",
"state": "published",
"provider": "WPScan",
"title": "Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass",
"descriptions": [
{
"lang": "en",
"value": "The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Membership For WooCommerce",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThan": "3.1.2",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "",
"lang": "en",
"description": "CWE-287 Improper Authentication",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/957888a4-bb11-42c6-930a-8c836170452b/",
"label": "WPScan",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"provider": "WPScan",
"sourcePath": "/containers/cna/references/0"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"Unknown\",\"product\":\"Membership For WooCommerce\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"3.1.2\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"description\":\"CWE-287 Improper Authentication\",\"lang\":\"en\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1",
"text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":5.3,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"LOW\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-08-19T16:38:02.711Z",
"fetchedAt": "2026-10-23T02:43:47.061Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-22T22:09:42.384Z",
"state": "published"
}
],
"sourceSummary": "Membership For WooCommerceに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:22:25.537Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "272cf731b1940e98b65d23ea2e72b558130ab454a08923eb789b00c327a7903a",
"sourceModifiedAt": "2026-10-22T16:09:59.560Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "Membership For WooCommerce プラグインはバージョン 3.1.2 未満において、API コンシューマーシークレットが実際に生成されているかを確認せず、リクエストに含まれるシークレットとだけ比較します。そのため、認証されていない攻撃者が REST エンドポイントにアクセスでき、API が有効化されているがキーが一度も生成されていないサイトで、任意のユーザーの会員プラン詳細を取得できます。",
"risk": "任意のユーザーの会員プランの詳細が外部に漏洩する可能性があります。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E2"
],
"applicability": [
{
"text": "プラグインのバージョンが 3.1.2 未満であること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json"
],
"evidenceIds": [
"E3",
"E1"
]
},
{
"text": "WordPress の REST API が有効化されていること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "API コンシューマーシークレットが一度も生成されていないこと。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "認証されていない攻撃者がリクエストを送信できること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "攻撃者が REST ルートに到達できること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "公式の対象表：Membership For WooCommerce。影響ありとして記載：3.1.2未満の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Membership For WooCommerce」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-19709",
"https://wpscan.com/vulnerability/957888a4-bb11-42c6-930a-8c836170452b/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-19709"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19709",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/957888a4-bb11-42c6-930a-8c836170452b/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19709",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json",
"sourceField": "/containers/cna/title",
"excerpt": "Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass",
"language": null
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19709.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"Unknown\",\"product\":\"Membership For WooCommerce\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"3.1.2\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-19709（Membership For WooCommerce）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・プラグインのバージョンが 3.1.2 未満であること。\n・WordPress の REST API が有効化されていること。\n・API コンシューマーシークレットが一度も生成されていないこと。\n・認証されていない攻撃者がリクエストを送信できること。\n・攻撃者が REST ルートに到達できること。\n・公式の対象表：Membership For WooCommerce。影響ありとして記載：3.1.2未満の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-19709",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:22:25.537Z",
"lastSuccess": "2026-10-23T03:22:25.537Z",
"sourceCheckedAt": "2026-10-23T02:43:47.061Z",
"errorCode": null
},
"glossary": []
}
},
{
"id": "CVE-2026-19406",
"aliases": [],
"title": "Easy Appointments：情報の漏えい",
"summary": "Easy Appointmentsプラグインのバージョン4.0.1未満では、投稿者（contributor）以上の権限を持つユーザーが予約一覧を取得するRESTエンドポイントを利用した際に、リクエストしたユーザーに属さない予約レコードも取得できるため、サイト上のすべての予約情報（顧客名、スケジュール、ステータス）を閲覧できてしまいます。",
"risk": "この問題により、顧客の氏名や予約日時、予約のステータスといった機密情報が、権限の低い投稿者レベルのユーザーに漏洩する可能性があります。",
"product": "Easy Appointments",
"category": "wordpress",
"component": "plugin",
"severity": "low",
"cvss": 2.7,
"cvssVersion": "3.1",
"cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"affected": [
{
"product": "Easy Appointments",
"range": ">= 3.12.28 / < 4.0.1"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19406",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/53cfb207-8f26-438c-a928-bc9271f312f0/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19406",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-08-19T06:00:20.837Z",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-23T02:43:47.023Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.",
"sourceTitle": "Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "Unknown",
"product": "Easy Appointments",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "3.12.28",
"lessThan": "4.0.1"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-19406",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json",
"fetchedAt": "2026-10-23T02:43:47.023Z",
"publishedAt": "2026-08-19T06:00:20.837Z",
"modifiedAt": "2026-08-19T16:34:36.190Z",
"state": "published",
"provider": "WPScan",
"title": "Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing",
"descriptions": [
{
"lang": "en",
"value": "The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Easy Appointments",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "3.12.28",
"lessThan": "4.0.1",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "",
"lang": "en",
"description": "CWE-200 Information Exposure",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 2.7,
"baseSeverity": "LOW",
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/53cfb207-8f26-438c-a928-bc9271f312f0/",
"label": "WPScan",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"provider": "WPScan",
"sourcePath": "/containers/cna/references/0"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"Unknown\",\"product\":\"Easy Appointments\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"3.12.28\",\"lessThan\":\"4.0.1\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"description\":\"CWE-200 Information Exposure\",\"lang\":\"en\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1",
"text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":2.7,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"LOW\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"HIGH\",\"confidentialityImpact\":\"LOW\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-08-19T16:34:36.190Z",
"fetchedAt": "2026-10-23T02:43:47.023Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-22T22:09:42.384Z",
"state": "published"
}
],
"sourceSummary": "Easy Appointmentsに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "本来公開しない情報を読み取られる可能性があります。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:22:26.722Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "eff97e7b02ee6010a665608fb56fe66693e31820a81313e7fe87b2aca2013cf6",
"sourceModifiedAt": "2026-10-22T16:09:59.560Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "Easy Appointmentsプラグインのバージョン4.0.1未満では、投稿者（contributor）以上の権限を持つユーザーが予約一覧を取得するRESTエンドポイントを利用した際に、リクエストしたユーザーに属さない予約レコードも取得できるため、サイト上のすべての予約情報（顧客名、スケジュール、ステータス）を閲覧できてしまいます。",
"risk": "この問題により、顧客の氏名や予約日時、予約のステータスといった機密情報が、権限の低い投稿者レベルのユーザーに漏洩する可能性があります。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E2"
],
"applicability": [
{
"text": "対象となるのは、Easy Appointmentsプラグインのバージョン3.12.28から4.0.1未満のすべてのリリースです。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json"
],
"evidenceIds": [
"E3",
"E1"
]
},
{
"text": "影響を受けるのは、WordPressサイト上で「投稿者（contributor）以上」の権限を持つユーザーが、予約一覧を取得するRESTエンドポイントにアクセスした場合です。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "公式の対象表：Easy Appointments。影響ありとして記載：3.12.28以上、4.0.1未満。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Easy Appointments」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-19406",
"https://wpscan.com/vulnerability/53cfb207-8f26-438c-a928-bc9271f312f0/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-19406"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19406",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/53cfb207-8f26-438c-a928-bc9271f312f0/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19406",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json",
"sourceField": "/containers/cna/title",
"excerpt": "Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing",
"language": null
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19406.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"Unknown\",\"product\":\"Easy Appointments\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"3.12.28\",\"lessThan\":\"4.0.1\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-19406（Easy Appointments）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象となるのは、Easy Appointmentsプラグインのバージョン3.12.28から4.0.1未満のすべてのリリースです。\n・影響を受けるのは、WordPressサイト上で「投稿者（contributor）以上」の権限を持つユーザーが、予約一覧を取得するRESTエンドポイントにアクセスした場合です。\n・公式の対象表：Easy Appointments。影響ありとして記載：3.12.28以上、4.0.1未満。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-19406",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:22:26.722Z",
"lastSuccess": "2026-10-23T03:22:26.722Z",
"sourceCheckedAt": "2026-10-23T02:43:47.023Z",
"errorCode": null
},
"glossary": []
}
},
{
"id": "CVE-2026-19056",
"aliases": [],
"title": "ProSolution WP Client：ブラウザー上での不正な処理",
"summary": "ProSolution WP Client WordPress プラグインはバージョン 2.0.11 未満で、管理画面のあるページに対して 'page' パラメータを HTML 属性にそのまま埋め込むため、サニタイズやエスケープが行われません。その結果、管理者が細工されたリクエストを送信すると、ページに反映されたスクリプトが実行されるリフレクティッド XSS が発生します。",
"risk": "管理者のセッション内で不正なスクリプトが実行され、管理者が意図しない操作や情報漏洩が起こる可能性があります。",
"product": "ProSolution WP Client",
"category": "wordpress",
"component": "plugin",
"severity": "high",
"cvss": 7.1,
"cvssVersion": "3.1",
"cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"affected": [
{
"product": "ProSolution WP Client",
"range": "< 2.0.11"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19056",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/83ad2038-3755-40a5-a8af-e6fac94341d1/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19056",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-08-19T06:00:20.663Z",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-23T02:43:47.019Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.",
"sourceTitle": "ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "Unknown",
"product": "ProSolution WP Client",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "2.0.11"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-19056",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json",
"fetchedAt": "2026-10-23T02:43:47.019Z",
"publishedAt": "2026-08-19T06:00:20.663Z",
"modifiedAt": "2026-08-19T16:27:26.942Z",
"state": "published",
"provider": "WPScan",
"title": "ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter",
"descriptions": [
{
"lang": "en",
"value": "The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "Unknown",
"product": "ProSolution WP Client",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThan": "2.0.11",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "",
"lang": "en",
"description": "CWE-79 Cross-Site Scripting (XSS)",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/83ad2038-3755-40a5-a8af-e6fac94341d1/",
"label": "WPScan",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"provider": "WPScan",
"sourcePath": "/containers/cna/references/0"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"Unknown\",\"product\":\"ProSolution WP Client\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"2.0.11\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"description\":\"CWE-79 Cross-Site Scripting (XSS)\",\"lang\":\"en\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1",
"text": "{\"scope\":\"CHANGED\",\"version\":\"3.1\",\"baseScore\":7.1,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\",\"integrityImpact\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"LOW\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"LOW\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-08-19T16:27:26.942Z",
"fetchedAt": "2026-10-23T02:43:47.019Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-22T22:09:42.384Z",
"state": "published"
}
],
"sourceSummary": "ProSolution WP Clientにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:22:26.804Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "5a89a17a6c520cd6a0cbbbb31ae1dfd65fc8839c159f7f975029379c347ffc7b",
"sourceModifiedAt": "2026-10-22T16:09:59.560Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "ProSolution WP Client WordPress プラグインはバージョン 2.0.11 未満で、管理画面のあるページに対して 'page' パラメータを HTML 属性にそのまま埋め込むため、サニタイズやエスケープが行われません。その結果、管理者が細工されたリクエストを送信すると、ページに反映されたスクリプトが実行されるリフレクティッド XSS が発生します。",
"risk": "管理者のセッション内で不正なスクリプトが実行され、管理者が意図しない操作や情報漏洩が起こる可能性があります。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E1"
],
"applicability": [
{
"text": "対象製品は ProSolution WP Client プラグインで、バージョンが 2.0.11 未満のものです。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json"
],
"evidenceIds": [
"E3",
"E2"
]
},
{
"text": "影響は管理者用ページの 'page' パラメータが HTML 属性にそのまま反映されるケースに限られます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "公式の対象表：ProSolution WP Client。影響ありとして記載：2.0.11未満の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「ProSolution WP Client」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-19056",
"https://wpscan.com/vulnerability/83ad2038-3755-40a5-a8af-e6fac94341d1/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-19056"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19056",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/83ad2038-3755-40a5-a8af-e6fac94341d1/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19056",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json",
"sourceField": "/containers/cna/title",
"excerpt": "ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter",
"language": null
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19056.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"Unknown\",\"product\":\"ProSolution WP Client\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"2.0.11\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-19056（ProSolution WP Client）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象製品は ProSolution WP Client プラグインで、バージョンが 2.0.11 未満のものです。\n・影響は管理者用ページの 'page' パラメータが HTML 属性にそのまま反映されるケースに限られます。\n・公式の対象表：ProSolution WP Client。影響ありとして記載：2.0.11未満の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-19056",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:22:26.804Z",
"lastSuccess": "2026-10-23T03:22:26.804Z",
"sourceCheckedAt": "2026-10-23T02:43:47.019Z",
"errorCode": null
},
"glossary": [
{
"term": "XSS",
"meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。",
"sourceUrl": "https://cwe.mitre.org/data/definitions/79.html",
"kind": "general_definition"
}
]
}
},
{
"id": "CVE-2026-19055",
"aliases": [],
"title": "ProSolution WP Client：ブラウザー上での不正な処理",
"summary": "ProSolution WP Client WordPress プラグインはバージョン 2.0.11 未満で、公開ページの HTML 属性にいくつかのパラメータをそのまま反映し、サニタイズやエスケープを行いません。その結果、任意の訪問者（ログイン中の管理者を含む）に対して、反射型クロスサイトスクリプティング（XSS）を引き起こすことができます。",
"risk": "ページを表示した人のブラウザーで不正なスクリプトが実行される可能性があります。",
"product": "ProSolution WP Client",
"category": "wordpress",
"component": "plugin",
"severity": "high",
"cvss": 7.1,
"cvssVersion": "3.1",
"cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"affected": [
{
"product": "ProSolution WP Client",
"range": "< 2.0.11"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19055",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/a1243ff3-3f0e-4068-a716-722e7cf4856b/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19055",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-08-19T06:00:20.487Z",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-23T02:43:46.980Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.",
"sourceTitle": "ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "Unknown",
"product": "ProSolution WP Client",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "2.0.11"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-19055",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json",
"fetchedAt": "2026-10-23T02:43:46.980Z",
"publishedAt": "2026-08-19T06:00:20.487Z",
"modifiedAt": "2026-08-19T16:25:40.127Z",
"state": "published",
"provider": "WPScan",
"title": "ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters",
"descriptions": [
{
"lang": "en",
"value": "The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "Unknown",
"product": "ProSolution WP Client",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThan": "2.0.11",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "",
"lang": "en",
"description": "CWE-79 Cross-Site Scripting (XSS)",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/a1243ff3-3f0e-4068-a716-722e7cf4856b/",
"label": "WPScan",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"provider": "WPScan",
"sourcePath": "/containers/cna/references/0"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"Unknown\",\"product\":\"ProSolution WP Client\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"2.0.11\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"description\":\"CWE-79 Cross-Site Scripting (XSS)\",\"lang\":\"en\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1",
"text": "{\"scope\":\"CHANGED\",\"version\":\"3.1\",\"baseScore\":7.1,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\",\"integrityImpact\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"LOW\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"LOW\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-08-19T16:25:40.127Z",
"fetchedAt": "2026-10-23T02:43:46.980Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-22T22:09:42.384Z",
"state": "published"
}
],
"sourceSummary": "ProSolution WP Clientにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:22:28.658Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "61b99e7f7d8829e5cd26ffcc651f2273dd69e0b8b06e4223ec76b0baa91fc46b",
"sourceModifiedAt": "2026-10-22T16:09:59.560Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "ProSolution WP Client WordPress プラグインはバージョン 2.0.11 未満で、公開ページの HTML 属性にいくつかのパラメータをそのまま反映し、サニタイズやエスケープを行いません。その結果、任意の訪問者（ログイン中の管理者を含む）に対して、反射型クロスサイトスクリプティング（XSS）を引き起こすことができます。",
"risk": "ページを表示した人のブラウザーで不正なスクリプトが実行される可能性があります。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E1"
],
"applicability": [
{
"text": "ProSolution WP Client のバージョンが 2.0.11 未満のすべてのインストールが影響を受けます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json"
],
"evidenceIds": [
"E3",
"E2"
]
},
{
"text": "影響を受けるのは、プラグインの公開ページを閲覧するすべての訪問者で、ログイン中の管理者も含まれます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "公式の対象表：ProSolution WP Client。影響ありとして記載：2.0.11未満の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「ProSolution WP Client」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-19055",
"https://wpscan.com/vulnerability/a1243ff3-3f0e-4068-a716-722e7cf4856b/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-19055"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19055",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/a1243ff3-3f0e-4068-a716-722e7cf4856b/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19055",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json",
"sourceField": "/containers/cna/title",
"excerpt": "ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters",
"language": null
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19055.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"Unknown\",\"product\":\"ProSolution WP Client\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"2.0.11\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-19055（ProSolution WP Client）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・ProSolution WP Client のバージョンが 2.0.11 未満のすべてのインストールが影響を受けます。\n・影響を受けるのは、プラグインの公開ページを閲覧するすべての訪問者で、ログイン中の管理者も含まれます。\n・公式の対象表：ProSolution WP Client。影響ありとして記載：2.0.11未満の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-19055",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:22:28.658Z",
"lastSuccess": "2026-10-23T03:22:28.658Z",
"sourceCheckedAt": "2026-10-23T02:43:46.980Z",
"errorCode": null
},
"glossary": [
{
"term": "XSS",
"meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。",
"sourceUrl": "https://cwe.mitre.org/data/definitions/79.html",
"kind": "general_definition"
}
]
}
},
{
"id": "CVE-2026-18202",
"aliases": [],
"title": "JetEngine：ブラウザー上での不正な処理",
"summary": "JetEngine WordPressプラグインはバージョン3.8.14未満で、SVGをサイト全体の許可されたアップロードタイプに追加しますが、ファイル内容をサニタイズしません。そのため、アップロード権限を持つユーザー（例: Author）が悪意あるJavaScriptを含むSVGをアップロードでき、これを開いた任意のユーザーのブラウザで実行される（保存型XSS）という脆弱性があります。マルチサイト環境では、ネットワーク管理者が設定したアップロードタイプ制限も上書きされます。",
"risk": "悪意あるJavaScriptがSVGを閲覧したユーザーのブラウザで実行され、ページ上で不正な操作が可能になる可能性があります。",
"product": "JetEngine",
"category": "wordpress",
"component": "plugin",
"severity": "medium",
"cvss": 6.8,
"cvssVersion": "3.1",
"cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"affected": [
{
"product": "JetEngine",
"range": "< 3.8.14"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18202",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/911d3b5a-0f03-4423-b4b0-84e588c323d8/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18202",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-08-19T06:00:18.765Z",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-23T02:43:46.918Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.",
"sourceTitle": "JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "Unknown",
"product": "JetEngine",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "3.8.14"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-18202",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json",
"fetchedAt": "2026-10-23T02:43:46.918Z",
"publishedAt": "2026-08-19T06:00:18.765Z",
"modifiedAt": "2026-08-19T16:10:47.047Z",
"state": "published",
"provider": "WPScan",
"title": "JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload",
"descriptions": [
{
"lang": "en",
"value": "The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "Unknown",
"product": "JetEngine",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThan": "3.8.14",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "",
"lang": "en",
"description": "CWE-79 Cross-Site Scripting (XSS)",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/911d3b5a-0f03-4423-b4b0-84e588c323d8/",
"label": "WPScan",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"provider": "WPScan",
"sourcePath": "/containers/cna/references/0"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"Unknown\",\"product\":\"JetEngine\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"3.8.14\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"description\":\"CWE-79 Cross-Site Scripting (XSS)\",\"lang\":\"en\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1",
"text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":6.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"confidentialityImpact\":\"HIGH\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-08-19T16:10:47.047Z",
"fetchedAt": "2026-10-23T02:43:46.918Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-22T22:09:42.384Z",
"state": "published"
}
],
"sourceSummary": "JetEngineにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:22:28.913Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "42d0765defa85396ca6e12706ec2eb0c5654c287b59141be05277e1645d20c24",
"sourceModifiedAt": "2026-10-22T16:09:59.560Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "JetEngine WordPressプラグインはバージョン3.8.14未満で、SVGをサイト全体の許可されたアップロードタイプに追加しますが、ファイル内容をサニタイズしません。そのため、アップロード権限を持つユーザー（例: Author）が悪意あるJavaScriptを含むSVGをアップロードでき、これを開いた任意のユーザーのブラウザで実行される（保存型XSS）という脆弱性があります。マルチサイト環境では、ネットワーク管理者が設定したアップロードタイプ制限も上書きされます。",
"risk": "悪意あるJavaScriptがSVGを閲覧したユーザーのブラウザで実行され、ページ上で不正な操作が可能になる可能性があります。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E1"
],
"applicability": [
{
"text": "JetEngineプラグインのバージョンが3.8.14未満であること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json"
],
"evidenceIds": [
"E3",
"E2"
]
},
{
"text": "WordPressにJetEngineプラグインがインストールされていること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "ユーザーが「upload_files」権限を持っていること（例: Authorロール）。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "SVGファイルをアップロードできること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "マルチサイト環境では、ネットワーク管理者が設定したアップロードタイプ制限が上書きされること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "公式の対象表：JetEngine。影響ありとして記載：3.8.14未満の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「JetEngine」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-18202",
"https://wpscan.com/vulnerability/911d3b5a-0f03-4423-b4b0-84e588c323d8/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-18202"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18202",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/911d3b5a-0f03-4423-b4b0-84e588c323d8/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18202",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json",
"sourceField": "/containers/cna/title",
"excerpt": "JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload",
"language": null
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18202.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"Unknown\",\"product\":\"JetEngine\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"3.8.14\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-18202（JetEngine）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・JetEngineプラグインのバージョンが3.8.14未満であること。\n・WordPressにJetEngineプラグインがインストールされていること。\n・ユーザーが「upload_files」権限を持っていること（例: Authorロール）。\n・SVGファイルをアップロードできること。\n・マルチサイト環境では、ネットワーク管理者が設定したアップロードタイプ制限が上書きされること。\n・公式の対象表：JetEngine。影響ありとして記載：3.8.14未満の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-18202",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:22:28.913Z",
"lastSuccess": "2026-10-23T03:22:28.913Z",
"sourceCheckedAt": "2026-10-23T02:43:46.918Z",
"errorCode": null
},
"glossary": [
{
"term": "XSS",
"meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。",
"sourceUrl": "https://cwe.mitre.org/data/definitions/79.html",
"kind": "general_definition"
}
]
}
},
{
"id": "CVE-2026-16617",
"aliases": [],
"title": "Simple File List：ブラウザー上での不正な処理",
"summary": "Simple File Listプラグインのバージョン6.3.11まででは、ファイルの説明文を公開ファイル一覧に出力する際に適切なサニタイズやエスケープが行われません。その結果、フロントエンドのファイル管理が有効になっている場合、認証されていないユーザーが説明文に悪意あるスクリプトを埋め込むことができ、一覧を閲覧する訪問者のブラウザーでスクリプトが実行されます。",
"risk": "訪問者のブラウザーで任意のスクリプトが実行される可能性があります。",
"product": "Simple File List",
"category": "wordpress",
"component": "plugin",
"severity": "high",
"cvss": 8.8,
"cvssVersion": "3.1",
"cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"affected": [
{
"product": "Simple File List",
"range": "<= 6.3.11"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16617",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/fc51a940-8e67-45d0-b47d-b16da288ebb3/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16617",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-08-19T06:00:17.365Z",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-23T02:43:46.758Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.",
"sourceTitle": "Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "Unknown",
"product": "Simple File List",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThanOrEqual": "6.3.11"
}
],
"defaultStatus": "unknown"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-16617",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json",
"fetchedAt": "2026-10-23T02:43:46.758Z",
"publishedAt": "2026-08-19T06:00:17.365Z",
"modifiedAt": "2026-08-19T17:49:46.832Z",
"state": "published",
"provider": "WPScan",
"title": "Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description",
"descriptions": [
{
"lang": "en",
"value": "The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Simple File List",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unknown",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThanOrEqual": "6.3.11",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "",
"lang": "en",
"description": "CWE-79 Cross-Site Scripting (XSS)",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/fc51a940-8e67-45d0-b47d-b16da288ebb3/",
"label": "WPScan",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"provider": "WPScan",
"sourcePath": "/containers/cna/references/0"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"Unknown\",\"product\":\"Simple File List\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"6.3.11\"}],\"defaultStatus\":\"unknown\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"description\":\"CWE-79 Cross-Site Scripting (XSS)\",\"lang\":\"en\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1",
"text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-08-19T17:49:46.832Z",
"fetchedAt": "2026-10-23T02:43:46.758Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-22T22:09:42.384Z",
"state": "published"
}
],
"sourceSummary": "Simple File Listにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:22:29.522Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "2c2defcc3691d16a89b7bcb1956abbc319460ad9ff624b0364cbb6b17daf5281",
"sourceModifiedAt": "2026-10-22T16:09:59.560Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "Simple File Listプラグインのバージョン6.3.11まででは、ファイルの説明文を公開ファイル一覧に出力する際に適切なサニタイズやエスケープが行われません。その結果、フロントエンドのファイル管理が有効になっている場合、認証されていないユーザーが説明文に悪意あるスクリプトを埋め込むことができ、一覧を閲覧する訪問者のブラウザーでスクリプトが実行されます。",
"risk": "訪問者のブラウザーで任意のスクリプトが実行される可能性があります。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E2"
],
"applicability": [
{
"text": "Simple File Listプラグインのバージョンが6.3.11以下であること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json"
],
"evidenceIds": [
"E3",
"E1"
]
},
{
"text": "フロントエンドのファイル管理機能が有効になっていること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "認証されていないユーザーでも攻撃が可能であること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "公式の対象表：Simple File List。影響ありとして記載：6.3.11以下の版。個別に記されていない版の影響は、原資料でも未確定です。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Simple File List」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-16617",
"https://wpscan.com/vulnerability/fc51a940-8e67-45d0-b47d-b16da288ebb3/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-16617"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16617",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/fc51a940-8e67-45d0-b47d-b16da288ebb3/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16617",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json",
"sourceField": "/containers/cna/title",
"excerpt": "Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description",
"language": null
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16617.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"Unknown\",\"product\":\"Simple File List\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"6.3.11\"}],\"defaultStatus\":\"unknown\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-16617（Simple File List）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Simple File Listプラグインのバージョンが6.3.11以下であること。\n・フロントエンドのファイル管理機能が有効になっていること。\n・認証されていないユーザーでも攻撃が可能であること。\n・公式の対象表：Simple File List。影響ありとして記載：6.3.11以下の版。個別に記されていない版の影響は、原資料でも未確定です。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-16617",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:22:29.522Z",
"lastSuccess": "2026-10-23T03:22:29.522Z",
"sourceCheckedAt": "2026-10-23T02:43:46.758Z",
"errorCode": null
},
"glossary": []
}
},
{
"id": "CVE-2026-16616",
"aliases": [],
"title": "Simple File List：ファイルへの不正アクセス",
"summary": "Simple File List プラグイン（バージョン 6.3.11 以下）は、認証されていないユーザーがファイル移動操作の元になるパスを検証しないため、任意のサーバー上のファイルを読み取ったり、重要なファイルをウェブルート外へ移動させることができます。",
"risk": "この脆弱性により、機密情報が漏洩し、サイトが乗っ取られる可能性があります。",
"product": "Simple File List",
"category": "wordpress",
"component": "plugin",
"severity": "high",
"cvss": 8.6,
"cvssVersion": "3.1",
"cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"affected": [
{
"product": "Simple File List",
"range": "<= 6.3.11"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16616",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16616",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-08-19T06:00:17.192Z",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-23T02:43:46.742Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.",
"sourceTitle": "Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "Unknown",
"product": "Simple File List",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThanOrEqual": "6.3.11"
}
],
"defaultStatus": "unknown"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-16616",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json",
"fetchedAt": "2026-10-23T02:43:46.742Z",
"publishedAt": "2026-08-19T06:00:17.192Z",
"modifiedAt": "2026-08-19T17:47:16.763Z",
"state": "published",
"provider": "WPScan",
"title": "Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal",
"descriptions": [
{
"lang": "en",
"value": "The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Simple File List",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unknown",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThanOrEqual": "6.3.11",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "",
"lang": "en",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba/",
"label": "WPScan",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"provider": "WPScan",
"sourcePath": "/containers/cna/references/0"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"Unknown\",\"product\":\"Simple File List\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"6.3.11\"}],\"defaultStatus\":\"unknown\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"description\":\"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\",\"lang\":\"en\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1",
"text": "{\"scope\":\"CHANGED\",\"version\":\"3.1\",\"baseScore\":8.6,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-08-19T17:47:16.763Z",
"fetchedAt": "2026-10-23T02:43:46.742Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-22T22:09:42.384Z",
"state": "published"
}
],
"sourceSummary": "Simple File Listにファイルへの不正アクセスに関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "許可していない場所のファイルにアクセスされる可能性があります。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:22:29.634Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "9c0c09e717b8fb818e56a12023cea1b7e172b0527c146e9e7043e7f35a81fa6e",
"sourceModifiedAt": "2026-10-22T16:09:59.560Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "Simple File List プラグイン（バージョン 6.3.11 以下）は、認証されていないユーザーがファイル移動操作の元になるパスを検証しないため、任意のサーバー上のファイルを読み取ったり、重要なファイルをウェブルート外へ移動させることができます。",
"risk": "この脆弱性により、機密情報が漏洩し、サイトが乗っ取られる可能性があります。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E2"
],
"applicability": [
{
"text": "対象製品は WordPress 用 Simple File List プラグインです。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json"
],
"evidenceIds": [
"E3",
"E1"
]
},
{
"text": "バージョン 6.3.11 以下が影響を受けます。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json"
],
"evidenceIds": [
"E3",
"E1"
]
},
{
"text": "認証されていないユーザーがファイル移動操作のソースパスを指定できる状態です。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "ソースパスの検証が行われないため、任意のファイルを読み取ることが可能です。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "検証されないパスを利用して、重要なファイルをウェブルート外へ移動させることが可能です。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json"
],
"evidenceIds": [
"E2",
"E1"
]
},
{
"text": "公式の対象表：Simple File List。影響ありとして記載：6.3.11以下の版。個別に記されていない版の影響は、原資料でも未確定です。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Simple File List」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-16616",
"https://wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-16616"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16616",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16616",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json",
"sourceField": "/containers/cna/title",
"excerpt": "Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal",
"language": null
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16616.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"Unknown\",\"product\":\"Simple File List\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"6.3.11\"}],\"defaultStatus\":\"unknown\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-16616（Simple File List）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象製品は WordPress 用 Simple File List プラグインです。\n・バージョン 6.3.11 以下が影響を受けます。\n・認証されていないユーザーがファイル移動操作のソースパスを指定できる状態です。\n・ソースパスの検証が行われないため、任意のファイルを読み取ることが可能です。\n・検証されないパスを利用して、重要なファイルをウェブルート外へ移動させることが可能です。\n・公式の対象表：Simple File List。影響ありとして記載：6.3.11以下の版。個別に記されていない版の影響は、原資料でも未確定です。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-16616",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:22:29.634Z",
"lastSuccess": "2026-10-23T03:22:29.634Z",
"sourceCheckedAt": "2026-10-23T02:43:46.742Z",
"errorCode": null
},
"glossary": []
}
},
{
"id": "CVE-2026-16570",
"aliases": [],
"title": "NextScripts: Social Networks Auto-Poster：ブラウザー上での不正な処理",
"summary": "NextScripts: Social Networks Auto-Poster プラグイン（バージョン 4.4.8 未満）は、管理者ページのクエリ文字列パラメータを適切にエスケープせずに表示するため、攻撃者が細工したリンクを開いたログイン中のユーザー（例: 管理者）に対して、ページを表示した人のブラウザーで不正な処理を動かす Reflected XSS 攻撃が可能になる。",
"risk": "攻撃者が細工したリンクを開いた管理者などのログインユーザーのブラウザーで不正なスクリプトが実行される可能性がある。",
"product": "NextScripts: Social Networks Auto-Poster",
"category": "wordpress",
"component": "plugin",
"severity": "high",
"cvss": 7.1,
"cvssVersion": "3.1",
"cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"affected": [
{
"product": "NextScripts: Social Networks Auto-Poster",
"range": "< 4.4.8"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16570",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/25c42ca3-ff25-4b43-a712-2876398d82ab/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16570",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-08-19T06:00:17.019Z",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-23T02:43:46.728Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are tricked into opening a crafted link.",
"sourceTitle": "NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "Unknown",
"product": "NextScripts: Social Networks Auto-Poster",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "4.4.8"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-16570",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json",
"fetchedAt": "2026-10-23T02:43:46.728Z",
"publishedAt": "2026-08-19T06:00:17.019Z",
"modifiedAt": "2026-08-19T14:07:09.716Z",
"state": "published",
"provider": "WPScan",
"title": "NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback",
"descriptions": [
{
"lang": "en",
"value": "The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are tricked into opening a crafted link.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "Unknown",
"product": "NextScripts: Social Networks Auto-Poster",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThan": "4.4.8",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "",
"lang": "en",
"description": "CWE-79 Cross-Site Scripting (XSS)",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/25c42ca3-ff25-4b43-a712-2876398d82ab/",
"label": "WPScan",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"provider": "WPScan",
"sourcePath": "/containers/cna/references/0"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"Unknown\",\"product\":\"NextScripts: Social Networks Auto-Poster\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"4.4.8\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are tricked into opening a crafted link.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"description\":\"CWE-79 Cross-Site Scripting (XSS)\",\"lang\":\"en\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1",
"text": "{\"scope\":\"CHANGED\",\"version\":\"3.1\",\"baseScore\":7.1,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\",\"integrityImpact\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"LOW\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"LOW\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-08-19T14:07:09.716Z",
"fetchedAt": "2026-10-23T02:43:46.728Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-22T22:09:42.384Z",
"state": "published"
}
],
"sourceSummary": "NextScripts: Social Networks Auto-Posterにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:22:33.391Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "64f79ef819c70903b064912e1876bce81e2a3fdee94b46e2eaf371c75cec5266",
"sourceModifiedAt": "2026-10-22T16:09:59.560Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "NextScripts: Social Networks Auto-Poster プラグイン（バージョン 4.4.8 未満）は、管理者ページのクエリ文字列パラメータを適切にエスケープせずに表示するため、攻撃者が細工したリンクを開いたログイン中のユーザー（例: 管理者）に対して、ページを表示した人のブラウザーで不正な処理を動かす Reflected XSS 攻撃が可能になる。",
"risk": "攻撃者が細工したリンクを開いた管理者などのログインユーザーのブラウザーで不正なスクリプトが実行される可能性がある。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E1"
],
"applicability": [
{
"text": "NextScripts: Social Networks Auto-Poster WordPress プラグインのバージョンが 4.4.8 未満である場合に影響を受ける。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json"
],
"evidenceIds": [
"E3",
"E2"
]
},
{
"text": "攻撃は、管理者などのログイン済みユーザーが細工されたリンクを開くことで実行される。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "公式の対象表：NextScripts: Social Networks Auto-Poster。影響ありとして記載：4.4.8未満の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「NextScripts: Social Networks Auto-Poster」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-16570",
"https://wpscan.com/vulnerability/25c42ca3-ff25-4b43-a712-2876398d82ab/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-16570"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16570",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/25c42ca3-ff25-4b43-a712-2876398d82ab/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16570",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are tricked into opening a crafted link.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json",
"sourceField": "/containers/cna/title",
"excerpt": "NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback",
"language": null
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16570.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"Unknown\",\"product\":\"NextScripts: Social Networks Auto-Poster\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"4.4.8\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-16570（NextScripts: Social Networks Auto-Poster）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・NextScripts: Social Networks Auto-Poster WordPress プラグインのバージョンが 4.4.8 未満である場合に影響を受ける。\n・攻撃は、管理者などのログイン済みユーザーが細工されたリンクを開くことで実行される。\n・公式の対象表：NextScripts: Social Networks Auto-Poster。影響ありとして記載：4.4.8未満の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-16570",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:22:33.391Z",
"lastSuccess": "2026-10-23T03:22:33.391Z",
"sourceCheckedAt": "2026-10-23T02:43:46.728Z",
"errorCode": null
},
"glossary": [
{
"term": "XSS",
"meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。",
"sourceUrl": "https://cwe.mitre.org/data/definitions/79.html",
"kind": "general_definition"
}
]
}
},
{
"id": "CVE-2026-16058",
"aliases": [],
"title": "YayCurrency：脆弱性情報",
"summary": "YayCurrency 3.3.5 未満の WordPress プラグインは、認証されていないユーザーがアクセスできる複数のマルチベンダー統合ハンドラに対して、権限や所有者の確認を行わないため、誰でも店舗の注文合計やベンダーの収益、残高台帳、出金履歴を ID を順に指定して取得できる。",
"risk": "攻撃者が注文合計やベンダーの収益・残高・出金履歴といった財務情報を取得できるため、機密性が失われる。",
"product": "YayCurrency",
"category": "wordpress",
"component": "plugin",
"severity": "medium",
"cvss": 5.3,
"cvssVersion": "3.1",
"cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"affected": [
{
"product": "YayCurrency",
"range": "< 3.3.5"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16058",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/d32d7086-9a43-4d98-80d7-18a3f82797bb/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16058",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-08-19T06:00:16.840Z",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-23T02:43:46.619Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers.",
"sourceTitle": "YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "Unknown",
"product": "YayCurrency",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "3.3.5"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-16058",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json",
"fetchedAt": "2026-10-23T02:43:46.619Z",
"publishedAt": "2026-08-19T06:00:16.840Z",
"modifiedAt": "2026-08-19T13:26:56.420Z",
"state": "published",
"provider": "WPScan",
"title": "YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration",
"descriptions": [
{
"lang": "en",
"value": "The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "Unknown",
"product": "YayCurrency",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThan": "3.3.5",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "",
"lang": "en",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/d32d7086-9a43-4d98-80d7-18a3f82797bb/",
"label": "WPScan",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"provider": "WPScan",
"sourcePath": "/containers/cna/references/0"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"Unknown\",\"product\":\"YayCurrency\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"3.3.5\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"description\":\"CWE-639 Authorization Bypass Through User-Controlled Key\",\"lang\":\"en\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1",
"text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":5.3,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"LOW\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-08-19T13:26:56.420Z",
"fetchedAt": "2026-10-23T02:43:46.619Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-22T22:09:42.384Z",
"state": "published"
}
],
"sourceSummary": "YayCurrencyに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:22:34.827Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "8d7b28fc321f83a5d0a071c141f0cb905f652ec69a9c3c09b364a6565e06cde6",
"sourceModifiedAt": "2026-10-22T16:09:59.560Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "YayCurrency 3.3.5 未満の WordPress プラグインは、認証されていないユーザーがアクセスできる複数のマルチベンダー統合ハンドラに対して、権限や所有者の確認を行わないため、誰でも店舗の注文合計やベンダーの収益、残高台帳、出金履歴を ID を順に指定して取得できる。",
"risk": "攻撃者が注文合計やベンダーの収益・残高・出金履歴といった財務情報を取得できるため、機密性が失われる。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E1"
],
"applicability": [
{
"text": "対象は YayCurrency プラグインのバージョンが 3.3.5 未満である WordPress 環境。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json"
],
"evidenceIds": [
"E3",
"E2"
]
},
{
"text": "影響を受けるのは、認証されていないユーザーがアクセスできるマルチベンダー統合ハンドラである。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "公式の対象表：YayCurrency。影響ありとして記載：3.3.5未満の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「YayCurrency」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-16058",
"https://wpscan.com/vulnerability/d32d7086-9a43-4d98-80d7-18a3f82797bb/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-16058"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16058",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/d32d7086-9a43-4d98-80d7-18a3f82797bb/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16058",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json",
"sourceField": "/containers/cna/title",
"excerpt": "YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration",
"language": null
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16058.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"Unknown\",\"product\":\"YayCurrency\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"3.3.5\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-16058（YayCurrency）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は YayCurrency プラグインのバージョンが 3.3.5 未満である WordPress 環境。\n・影響を受けるのは、認証されていないユーザーがアクセスできるマルチベンダー統合ハンドラである。\n・公式の対象表：YayCurrency。影響ありとして記載：3.3.5未満の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-16058",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:22:34.827Z",
"lastSuccess": "2026-10-23T03:22:34.827Z",
"sourceCheckedAt": "2026-10-23T02:43:46.619Z",
"errorCode": null
},
"glossary": []
}
},
{
"id": "CVE-2026-15253",
"aliases": [],
"title": "Easy Media Replace：ブラウザー上での不正な処理",
"summary": "Easy Media Replace WordPressプラグインはバージョン0.2.0まで、メディアライブラリの一覧表示で添付ファイルのタイトルをHTML属性に出力する際にサニタイズやエスケープを行わない。そのため、Authorロール以上のユーザーが任意のウェブスクリプトを注入でき、メディアライブラリを閲覧する権限の高いユーザーのブラウザーでそのスクリプトが実行される。",
"risk": "権限の高いユーザーのブラウザーで不正なスクリプトが実行され、ページ上で任意の操作が可能になる可能性がある。",
"product": "Easy Media Replace",
"category": "wordpress",
"component": "plugin",
"severity": "medium",
"cvss": 6.8,
"cvssVersion": "3.1",
"cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"affected": [
{
"product": "Easy Media Replace",
"range": "<= 0.2.0"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15253",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/46eda528-3737-4c0d-bf72-df7fc6423907/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15253",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-08-19T06:00:16.637Z",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-23T02:43:46.431Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a higher privileged user who views the media library.",
"sourceTitle": "Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "Unknown",
"product": "Easy Media Replace",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThanOrEqual": "0.2.0"
}
],
"defaultStatus": "unknown"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-15253",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json",
"fetchedAt": "2026-10-23T02:43:46.431Z",
"publishedAt": "2026-08-19T06:00:16.637Z",
"modifiedAt": "2026-08-19T13:26:18.694Z",
"state": "published",
"provider": "WPScan",
"title": "Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title",
"descriptions": [
{
"lang": "en",
"value": "The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a higher privileged user who views the media library.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Easy Media Replace",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unknown",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThanOrEqual": "0.2.0",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "",
"lang": "en",
"description": "CWE-79 Cross-Site Scripting (XSS)",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/46eda528-3737-4c0d-bf72-df7fc6423907/",
"label": "WPScan",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"provider": "WPScan",
"sourcePath": "/containers/cna/references/0"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"Unknown\",\"product\":\"Easy Media Replace\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"0.2.0\"}],\"defaultStatus\":\"unknown\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a higher privileged user who views the media library.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"description\":\"CWE-79 Cross-Site Scripting (XSS)\",\"lang\":\"en\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1",
"text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":6.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"confidentialityImpact\":\"HIGH\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-08-19T13:26:18.694Z",
"fetchedAt": "2026-10-23T02:43:46.431Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-22T22:09:42.384Z",
"state": "published"
}
],
"sourceSummary": "Easy Media Replaceにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:22:35.361Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "77149284158ddf51cbb40d93bbe9c32116099a988ae5bc2a530e542b888aec3a",
"sourceModifiedAt": "2026-10-22T16:09:59.560Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "Easy Media Replace WordPressプラグインはバージョン0.2.0まで、メディアライブラリの一覧表示で添付ファイルのタイトルをHTML属性に出力する際にサニタイズやエスケープを行わない。そのため、Authorロール以上のユーザーが任意のウェブスクリプトを注入でき、メディアライブラリを閲覧する権限の高いユーザーのブラウザーでそのスクリプトが実行される。",
"risk": "権限の高いユーザーのブラウザーで不正なスクリプトが実行され、ページ上で任意の操作が可能になる可能性がある。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E1"
],
"applicability": [
{
"text": "Easy Media Replaceプラグインのバージョンが0.2.0以下であること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json"
],
"evidenceIds": [
"E3",
"E2"
]
},
{
"text": "WordPressのメディアライブラリ一覧画面が使用されていること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "添付ファイルのタイトルがHTML属性として出力されること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "攻撃者がAuthorロール以上の権限を持っていること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "被害者がメディアライブラリを閲覧できる権限（例: 管理者等）を持っていること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "公式の対象表：Easy Media Replace。影響ありとして記載：0.2.0以下の版。個別に記されていない版の影響は、原資料でも未確定です。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Easy Media Replace」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-15253",
"https://wpscan.com/vulnerability/46eda528-3737-4c0d-bf72-df7fc6423907/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-15253"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15253",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/46eda528-3737-4c0d-bf72-df7fc6423907/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15253",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a higher privileged user who views the media library.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json",
"sourceField": "/containers/cna/title",
"excerpt": "Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title",
"language": null
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15253.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"Unknown\",\"product\":\"Easy Media Replace\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"0.2.0\"}],\"defaultStatus\":\"unknown\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-15253（Easy Media Replace）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Easy Media Replaceプラグインのバージョンが0.2.0以下であること。\n・WordPressのメディアライブラリ一覧画面が使用されていること。\n・添付ファイルのタイトルがHTML属性として出力されること。\n・攻撃者がAuthorロール以上の権限を持っていること。\n・被害者がメディアライブラリを閲覧できる権限（例: 管理者等）を持っていること。\n・公式の対象表：Easy Media Replace。影響ありとして記載：0.2.0以下の版。個別に記されていない版の影響は、原資料でも未確定です。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-15253",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:22:35.361Z",
"lastSuccess": "2026-10-23T03:22:35.361Z",
"sourceCheckedAt": "2026-10-23T02:43:46.431Z",
"errorCode": null
},
"glossary": []
}
},
{
"id": "CVE-2026-14861",
"aliases": [],
"title": "User Verification by PickPlugins：脆弱性情報",
"summary": "User Verification by PickPlugins WordPress プラグイン（バージョン 2.0.47 まで）は、検証メール再送リクエストが対象ユーザーに対して許可されているかを確認せず、保護トークンをそのユーザーに結び付けてもいません。その結果、認証されていない攻撃者が任意のユーザー（管理者を含む）のメール認証状態をリセットし、アカウントからロックアウトできるという脆弱性があります。",
"risk": "攻撃者により任意のユーザーが自分のアカウントにログインできなくなり、管理者でさえロックアウトされる可能性があります。",
"product": "User Verification by PickPlugins",
"category": "wordpress",
"component": "plugin",
"severity": "high",
"cvss": 7.5,
"cvssVersion": "3.1",
"cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"affected": [
{
"product": "User Verification by PickPlugins",
"range": "<= 2.0.47"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14861",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/4dff3634-4b4f-48e2-a8c9-dda7e2b682fd/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14861",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-08-19T06:00:16.169Z",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-23T02:43:46.334Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts.",
"sourceTitle": "User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "Unknown",
"product": "User Verification by PickPlugins",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThanOrEqual": "2.0.47"
}
],
"defaultStatus": "unknown"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-14861",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json",
"fetchedAt": "2026-10-23T02:43:46.334Z",
"publishedAt": "2026-08-19T06:00:16.169Z",
"modifiedAt": "2026-08-19T13:15:28.942Z",
"state": "published",
"provider": "WPScan",
"title": "User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR",
"descriptions": [
{
"lang": "en",
"value": "The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "Unknown",
"product": "User Verification by PickPlugins",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unknown",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThanOrEqual": "2.0.47",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "",
"lang": "en",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/4dff3634-4b4f-48e2-a8c9-dda7e2b682fd/",
"label": "WPScan",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"provider": "WPScan",
"sourcePath": "/containers/cna/references/0"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"Unknown\",\"product\":\"User Verification by PickPlugins\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"2.0.47\"}],\"defaultStatus\":\"unknown\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"description\":\"CWE-639 Authorization Bypass Through User-Controlled Key\",\"lang\":\"en\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1",
"text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.5,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"NONE\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-08-19T13:15:28.942Z",
"fetchedAt": "2026-10-23T02:43:46.334Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-22T22:09:42.384Z",
"state": "published"
}
],
"sourceSummary": "User Verification by PickPluginsに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:22:35.909Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "74c9190164aa7be00b357e4ad0eb066e4add81760686300dee136ef023401e99",
"sourceModifiedAt": "2026-10-22T16:09:59.560Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "User Verification by PickPlugins WordPress プラグイン（バージョン 2.0.47 まで）は、検証メール再送リクエストが対象ユーザーに対して許可されているかを確認せず、保護トークンをそのユーザーに結び付けてもいません。その結果、認証されていない攻撃者が任意のユーザー（管理者を含む）のメール認証状態をリセットし、アカウントからロックアウトできるという脆弱性があります。",
"risk": "攻撃者により任意のユーザーが自分のアカウントにログインできなくなり、管理者でさえロックアウトされる可能性があります。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E1"
],
"applicability": [
{
"text": "WordPress に User Verification by PickPlugins プラグインがインストールされ、バージョンが 2.0.47 以下である環境。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json"
],
"evidenceIds": [
"E3",
"E2"
]
},
{
"text": "認証されていない外部から、任意のユーザー ID を指定して検証メール再送リクエストを送信できる状態。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "公式の対象表：User Verification by PickPlugins。影響ありとして記載：2.0.47以下の版。個別に記されていない版の影響は、原資料でも未確定です。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「User Verification by PickPlugins」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-14861",
"https://wpscan.com/vulnerability/4dff3634-4b4f-48e2-a8c9-dda7e2b682fd/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-14861"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14861",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/4dff3634-4b4f-48e2-a8c9-dda7e2b682fd/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14861",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json",
"sourceField": "/containers/cna/title",
"excerpt": "User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR",
"language": null
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14861.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"Unknown\",\"product\":\"User Verification by PickPlugins\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"2.0.47\"}],\"defaultStatus\":\"unknown\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-14861（User Verification by PickPlugins）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・WordPress に User Verification by PickPlugins プラグインがインストールされ、バージョンが 2.0.47 以下である環境。\n・認証されていない外部から、任意のユーザー ID を指定して検証メール再送リクエストを送信できる状態。\n・公式の対象表：User Verification by PickPlugins。影響ありとして記載：2.0.47以下の版。個別に記されていない版の影響は、原資料でも未確定です。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-14861",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:22:35.909Z",
"lastSuccess": "2026-10-23T03:22:35.909Z",
"sourceCheckedAt": "2026-10-23T02:43:46.334Z",
"errorCode": null
},
"glossary": []
}
},
{
"id": "CVE-2026-14826",
"aliases": [],
"title": "Quiz and Survey Master (QSM)：脆弱性情報",
"summary": "Quiz and Survey Master (QSM) の WordPress プラグインはバージョン 11.2.4 未満で、REST ルートがクイズのメール通知および結果ページ設定を返す際に、オブジェクトごとの所有権チェックを行わない。そのため、貢献者レベル以上の権限を持つユーザーは、他のユーザーが作成したクイズの設定（通知先メールアドレスなど）を読むことができる。",
"risk": "攻撃者は他のユーザーが作成したクイズのメール通知先アドレスなどの設定情報を取得できる。",
"product": "Quiz and Survey Master (QSM)",
"category": "wordpress",
"component": "plugin",
"severity": "low",
"cvss": 2.7,
"cvssVersion": "3.1",
"cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"affected": [
{
"product": "Quiz and Survey Master (QSM)",
"range": "< 11.2.4"
}
],
"fixed": [],
"steps": [
"利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。"
],
"references": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14826",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/bb9cac20-4df5-4834-89f0-746a5eab20ea/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14826",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"publishedAt": "2026-08-19T06:00:15.994Z",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-23T02:43:46.331Z",
"exploitStatus": "unknown",
"sources": [
"CVE",
"NVD"
],
"originalText": "The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.",
"sourceTitle": "Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR",
"summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。",
"state": "published",
"affectedDetails": [
{
"vendor": "Unknown",
"product": "Quiz and Survey Master (QSM)",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "11.2.4"
}
],
"defaultStatus": "unaffected"
}
],
"officialEvidence": {
"schemaVersion": "1.0",
"id": "CVE-2026-14826",
"sourceType": "CVE",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json",
"fetchedAt": "2026-10-23T02:43:46.331Z",
"publishedAt": "2026-08-19T06:00:15.994Z",
"modifiedAt": "2026-08-19T13:14:55.802Z",
"state": "published",
"provider": "WPScan",
"title": "Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR",
"descriptions": [
{
"lang": "en",
"value": "The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.",
"sourcePath": "/containers/cna/descriptions/0/value"
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Quiz and Survey Master (QSM)",
"sourcePath": "/containers/cna/affected/0",
"defaultStatus": "unaffected",
"platforms": [],
"modules": [],
"programFiles": [],
"cpes": [],
"programRoutines": [],
"versions": [
{
"sourcePath": "/containers/cna/affected/0/versions/0",
"version": "0",
"lessThan": "11.2.4",
"versionType": "semver",
"status": "affected"
}
]
}
],
"solutions": [],
"workarounds": [],
"exploits": [],
"rejectedReasons": [],
"problemTypes": [
{
"cweId": "",
"lang": "en",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0"
}
],
"metrics": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 2.7,
"baseSeverity": "LOW",
"provider": "CISA-ADP",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1"
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/bb9cac20-4df5-4834-89f0-746a5eab20ea/",
"label": "WPScan",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"provider": "WPScan",
"sourcePath": "/containers/cna/references/0"
}
],
"snippets": [
{
"evidenceId": "official:/containers/cna/affected/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json",
"sourcePath": "/containers/cna/affected/0",
"text": "{\"vendor\":\"Unknown\",\"product\":\"Quiz and Survey Master (QSM)\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"11.2.4\"}],\"defaultStatus\":\"unaffected\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/cna/descriptions/0/value",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json",
"sourcePath": "/containers/cna/descriptions/0/value",
"text": "The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.",
"truncated": false,
"representation": "source_excerpt"
},
{
"evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json",
"sourcePath": "/containers/cna/problemTypes/0/descriptions/0",
"text": "{\"description\":\"CWE-639 Authorization Bypass Through User-Controlled Key\",\"lang\":\"en\",\"type\":\"CWE\"}",
"truncated": false,
"representation": "source_json"
},
{
"evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json",
"sourcePath": "/containers/adp/0/metrics/0/cvssV3_1",
"text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":2.7,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"LOW\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"HIGH\",\"confidentialityImpact\":\"LOW\"}",
"truncated": false,
"representation": "source_json"
}
],
"limits": {
"completeness": "official_record",
"truncatedFields": [],
"note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。"
}
},
"sourceSnapshots": [
{
"source": "CVE",
"modifiedAt": "2026-08-19T13:14:55.802Z",
"fetchedAt": "2026-10-23T02:43:46.331Z",
"state": "published"
},
{
"source": "NVD",
"modifiedAt": "2026-10-22T16:09:59.560Z",
"fetchedAt": "2026-10-22T22:09:42.384Z",
"state": "published"
}
],
"sourceSummary": "Quiz and Survey Master (QSM)に脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。",
"sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。",
"guidance": {
"schemaVersion": "1.0",
"method": "automatic",
"reviewedAt": null,
"reviewState": "current",
"generatedAt": "2026-10-23T03:22:35.929Z",
"generatorVersion": "2026-10-23.3",
"sourceFingerprint": "6c33037dd675e6f8d12d459c1bb5d5ae10999afc54ff524a32ad7d9a59fe8846",
"sourceModifiedAt": "2026-10-22T16:09:59.560Z",
"model": "@cf/openai/gpt-oss-120b",
"verificationMethod": "exact_source_excerpt_and_independent_semantic_check",
"summary": "Quiz and Survey Master (QSM) の WordPress プラグインはバージョン 11.2.4 未満で、REST ルートがクイズのメール通知および結果ページ設定を返す際に、オブジェクトごとの所有権チェックを行わない。そのため、貢献者レベル以上の権限を持つユーザーは、他のユーザーが作成したクイズの設定（通知先メールアドレスなど）を読むことができる。",
"risk": "攻撃者は他のユーザーが作成したクイズのメール通知先アドレスなどの設定情報を取得できる。",
"summaryEvidenceIds": [
"E1",
"E2"
],
"riskEvidenceIds": [
"E1"
],
"applicability": [
{
"text": "対象は Quiz and Survey Master (QSM) の WordPress プラグインで、バージョンが 11.2.4 未満であること。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json"
],
"evidenceIds": [
"E3",
"E2"
]
},
{
"text": "影響を受ける機能は、クイズのメール通知設定および結果ページ設定を返す REST ルートである。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "このチェックが欠如しているため、オブジェクトごとの所有権確認が行われない。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "貢献者レベル以上（contributor+）の権限を持つユーザーが対象となる。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "対象ユーザーは他のユーザーが作成したクイズの設定情報を読み取ることができる。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json"
],
"evidenceIds": [
"E1",
"E2"
]
},
{
"text": "公式の対象表：Quiz and Survey Master (QSM)。影響ありとして記載：11.2.4未満の版。",
"kind": "fact",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json"
],
"evidenceIds": [
"E3"
]
}
],
"versionChecks": [
{
"text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Quiz and Survey Master (QSM)」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/"
]
},
{
"text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/site-health-screen/",
"https://wordpress.org/documentation/article/plugins-screen/"
]
}
],
"actions": [
{
"text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json"
],
"evidenceIds": [
"E3"
]
}
],
"temporaryMitigations": [
{
"text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/plugins-screen/",
"https://www.cve.org/CVERecord?id=CVE-2026-14826",
"https://wpscan.com/vulnerability/bb9cac20-4df5-4834-89f0-746a5eab20ea/",
"https://nvd.nist.gov/vuln/detail/CVE-2026-14826"
]
}
],
"verification": [
{
"text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。",
"kind": "procedure",
"sourceUrls": [
"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json"
],
"evidenceIds": [
"E3"
]
},
{
"text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。",
"kind": "procedure",
"sourceUrls": [
"https://wordpress.org/documentation/article/updating-wordpress/",
"https://wordpress.org/documentation/article/dashboard-updates-screen/"
]
}
],
"unknowns": [
"この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。",
"今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。"
],
"sources": [
{
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json",
"label": "CVE：WPScan"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14826",
"label": "CVE公式レコード"
},
{
"url": "https://wpscan.com/vulnerability/bb9cac20-4df5-4834-89f0-746a5eab20ea/",
"label": "contact@wpscan.com"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14826",
"label": "NVDの原文"
},
{
"url": "https://www.first.org/cvss/v3.1/specification-document",
"label": "FIRST公式：CVSS 3.1の条件の定義"
},
{
"url": "https://wordpress.org/documentation/article/plugins-screen/",
"label": "WordPress公式：プラグイン一覧"
},
{
"url": "https://wordpress.org/documentation/article/site-health-screen/",
"label": "WordPress公式：サイトヘルスの情報"
},
{
"url": "https://wordpress.org/documentation/article/updating-wordpress/",
"label": "WordPress公式：本体の更新"
},
{
"url": "https://wordpress.org/documentation/article/dashboard-updates-screen/",
"label": "WordPress公式：更新画面"
},
{
"url": "https://wordpress.org/documentation/article/manage-plugins/",
"label": "WordPress公式：プラグインの確認と更新"
}
],
"evidence": [
{
"id": "E1",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json",
"sourceField": "/containers/cna/descriptions/0/value",
"excerpt": "The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.",
"language": "en",
"representation": "source_excerpt"
},
{
"id": "E2",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json",
"sourceField": "/containers/cna/title",
"excerpt": "Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR",
"language": null
},
{
"id": "E3",
"sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/14xxx/CVE-2026-14826.json",
"sourceField": "/containers/cna/affected/0",
"excerpt": "{\"vendor\":\"Unknown\",\"product\":\"Quiz and Survey Master (QSM)\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThan\":\"11.2.4\"}],\"defaultStatus\":\"unaffected\"}",
"language": null,
"representation": "source_json"
}
],
"supportRequest": "件名：CVE-2026-14826（Quiz and Survey Master (QSM)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は Quiz and Survey Master (QSM) の WordPress プラグインで、バージョンが 11.2.4 未満であること。\n・影響を受ける機能は、クイズのメール通知設定および結果ページ設定を返す REST ルートである。\n・このチェックが欠如しているため、オブジェクトごとの所有権確認が行われない。\n・貢献者レベル以上（contributor+）の権限を持つユーザーが対象となる。\n・対象ユーザーは他のユーザーが作成したクイズの設定情報を読み取ることができる。\n・公式の対象表：Quiz and Survey Master (QSM)。影響ありとして記載：11.2.4未満の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-14826",
"publicationCheckVersion": "2026-10-23.1",
"sourceNotices": [],
"automation": {
"status": "ready",
"lastAttempt": "2026-10-23T03:22:35.929Z",
"lastSuccess": "2026-10-23T03:22:35.929Z",
"sourceCheckedAt": "2026-10-23T02:43:46.331Z",
"errorCode": null
},
"glossary": []
}
}
],
"total": 350,
"limit": 20,
"offset": 300,
"filters": {
"product": "wordpress",
"type": "all",
"q": "",
"page": 16
},
"pagination": {
"page": 16,
"pageSize": 20,
"totalPages": 18
},
"sources": [
{
"name": "JVN",
"status": "ok",
"lastSuccess": "2026-10-23T07:17:49.537Z",
"lastAttempt": "2026-10-23T07:17:49.537Z",
"error": null,
"recordCount": 20,
"coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。",
"cursor": null,
"freshness": "fresh",
"stale": false
},
{
"name": "PHP Security",
"status": "ok",
"lastSuccess": "2026-10-23T07:17:49.537Z",
"lastAttempt": "2026-10-23T07:17:49.537Z",
"error": null,
"recordCount": 66,
"coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。",
"cursor": null,
"freshness": "fresh",
"stale": false
},
{
"name": "CISA KEV",
"status": "ok",
"lastSuccess": "2026-10-23T07:17:49.537Z",
"lastAttempt": "2026-10-23T07:17:49.537Z",
"error": null,
"recordCount": 1754,
"coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。",
"cursor": null,
"freshness": "fresh",
"stale": false
},
{
"name": "NVD",
"status": "ok",
"lastSuccess": "2026-10-23T07:17:49.537Z",
"lastAttempt": "2026-10-23T07:17:49.537Z",
"error": null,
"recordCount": 20,
"coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T06:02:49.165Z 〜 2026-10-23T07:17:49.537Z、全製品の変更 31/31件まで確認、対象20件反映。",
"cursor": null,
"freshness": "fresh",
"stale": false
},
{
"name": "CVE",
"status": "ok",
"lastSuccess": "2026-10-23T07:17:49.537Z",
"lastAttempt": "2026-10-23T07:17:49.537Z",
"error": null,
"recordCount": 6,
"coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。",
"cursor": null,
"freshness": "fresh",
"stale": false
}
]
}