{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-94231", "aliases": [], "title": "TrueBooker：脆弱性情報", "summary": "TrueBookerに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "TrueBooker", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "TrueBooker", "range": ">= 1.1.9 / < 1.3.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94231", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/d90ad3f4-4d58-43bc-8f17-0f6b8dfdde4f/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:32.710Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.", "sourceTitle": "CVE-2026-94231", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "TrueBooker", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "1.1.9", "lessThan": "1.3.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-94230", "aliases": [], "title": "TrueBooker：脆弱性情報", "summary": "TrueBookerに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "TrueBooker", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "TrueBooker", "range": ">= 1.1.9 / < 1.3.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94230", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/05881cde-313e-47d5-a176-2b0b0051bca9/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:32.580Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.", "sourceTitle": "CVE-2026-94230", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "TrueBooker", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "1.1.9", "lessThan": "1.3.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-94229", "aliases": [], "title": "TrueBooker：脆弱性情報", "summary": "TrueBookerに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "TrueBooker", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "TrueBooker", "range": ">= 1.1.9 / < 1.3.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94229", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/6041298d-1e66-4fba-9cc1-7b55e591ffaf/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:32.450Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.", "sourceTitle": "CVE-2026-94229", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "TrueBooker", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "1.1.9", "lessThan": "1.3.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-94228", "aliases": [], "title": "TrueBooker：脆弱性情報", "summary": "TrueBookerに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "TrueBooker", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "TrueBooker", "range": ">= 1.1.9 / < 1.3.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94228", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/fda8b7cb-2e7b-4aa1-9d9e-c6d93bf47332/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:32.320Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.", "sourceTitle": "CVE-2026-94228", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "TrueBooker", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "1.1.9", "lessThan": "1.3.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-91831", "aliases": [], "title": "Subscribe to Comments：脆弱性情報", "summary": "Subscribe to Commentsに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Subscribe to Comments", "category": "wordpress", "component": "plugin", "severity": "low", "cvss": 3.8, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "affected": [ { "product": "Subscribe to Comments", "range": ">= 2.3 / < 2.3.3" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91831", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/6cd60f78-f5e2-4b4a-8d50-7d2bc4f981ee/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:32.187Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.", "sourceTitle": "CVE-2026-91831", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Subscribe to Comments", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "2.3", "lessThan": "2.3.3", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-86791", "aliases": [], "title": "iPOSpays Payment Gateway for WooCommerce：脆弱性情報", "summary": "iPOSpays Payment Gateway for WooCommerceに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "iPOSpays Payment Gateway for WooCommerce", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "iPOSpays Payment Gateway for WooCommerce", "range": "< 1.4.7" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86791", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/04e70988-b0af-4f78-8e75-5e76976b1797/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:32.043Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.", "sourceTitle": "CVE-2026-86791", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "iPOSpays Payment Gateway for WooCommerce", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "0", "lessThan": "1.4.7", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-74922", "aliases": [], "title": "Document Gallery：脆弱性情報", "summary": "Document Galleryに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Document Gallery", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Document Gallery", "range": ">= 4.1 / <= 5.1.1" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74922", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/850aaa4e-82ff-479f-bdcd-6cb8089325bd/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:31.760Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.", "sourceTitle": "CVE-2026-74922", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Document Gallery", "defaultStatus": "unknown", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "4.1", "lessThanOrEqual": "5.1.1", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-74921", "aliases": [], "title": "Document Gallery：脆弱性情報", "summary": "Document Galleryに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Document Gallery", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.8, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "affected": [ { "product": "Document Gallery", "range": ">= 4.0 / <= 5.1.1" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74921", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/b0b97661-c671-420c-8fca-22666862b379/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:31.613Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.", "sourceTitle": "CVE-2026-74921", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Document Gallery", "defaultStatus": "unknown", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "4.0", "lessThanOrEqual": "5.1.1", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-110034", "aliases": [], "title": "Salon Booking System：脆弱性情報", "summary": "Salon Booking Systemに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Salon Booking System", "category": "wordpress", "component": "plugin", "severity": "low", "cvss": 3.7, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Salon Booking System", "range": "< 10.31.11" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110034", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/e3a64d4d-92db-4dbc-a0b5-58bca4d8b5c4/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:30.513Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.", "sourceTitle": "CVE-2026-110034", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Salon Booking System", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "0", "lessThan": "10.31.11", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-106010", "aliases": [], "title": "BDM Digital Payment Gateway：脆弱性情報", "summary": "BDM Digital Payment Gatewayに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "BDM Digital Payment Gateway", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "BDM Digital Payment Gateway", "range": ">= 1.2.7 / <= 1.3.12" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106010", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/fba20275-4836-4f19-aad9-c6f4e2c53b88/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:30.397Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.", "sourceTitle": "CVE-2026-106010", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "BDM Digital Payment Gateway", "defaultStatus": "unknown", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "1.2.7", "lessThanOrEqual": "1.3.12", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ] }, { "id": "CVE-2026-103311", "aliases": [], "title": "Coinbase Commerce Payment Gateway for WooCommerce：脆弱性情報", "summary": "Coinbase Commerce Payment Gateway for WooCommerceに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Coinbase Commerce Payment Gateway for WooCommerce", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Coinbase Commerce Payment Gateway for WooCommerce", "range": "<= 1.4.1" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103311", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/3d43ae6a-ca0d-49f9-aa3a-a584e5155efe/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:30.260Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.", "sourceTitle": "CVE-2026-103311", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Coinbase Commerce Payment Gateway for WooCommerce", "defaultStatus": "unknown", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "0", "lessThanOrEqual": "1.4.1", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ] }, { "id": "CVE-2026-94273", "aliases": [], "title": "Snap Finance：脆弱性情報", "summary": "Snap Financeに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Snap Finance", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Snap Finance", "range": "<= 3.11.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94273", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/62c8b34a-44f3-4739-9ca6-fce0f2a5ffaf/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T06:17:25.523Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.", "sourceTitle": "CVE-2026-94273", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Snap Finance", "defaultStatus": "unknown", "versions": [ { "version": "0", "lessThanOrEqual": "3.11.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-91047", "aliases": [], "title": "ElementsReady Addons for Elementor：脆弱性情報", "summary": "ElementsReady Addons for Elementorに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "ElementsReady Addons for Elementor", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "ElementsReady Addons for Elementor", "range": "<= 6.7.2" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91047", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/08afea88-4268-40b3-b5fb-0ac2546c3100/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T06:17:25.390Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.", "sourceTitle": "CVE-2026-91047", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "ElementsReady Addons for Elementor", "defaultStatus": "unknown", "versions": [ { "version": "0", "lessThanOrEqual": "6.7.2", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-91046", "aliases": [], "title": "ElementsReady Addons for Elementor：脆弱性情報", "summary": "ElementsReady Addons for Elementorに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "ElementsReady Addons for Elementor", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "ElementsReady Addons for Elementor", "range": "<= 6.7.2" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91046", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/ed5271e4-3e8d-49b6-9118-2f4ef5116043/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T06:17:25.223Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.", "sourceTitle": "CVE-2026-91046", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "ElementsReady Addons for Elementor", "defaultStatus": "unknown", "versions": [ { "version": "0", "lessThanOrEqual": "6.7.2", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-89286", "aliases": [], "title": "FormFlow for GoHighLevel (GHL)：脆弱性情報", "summary": "FormFlow for GoHighLevel (GHL)に脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "FormFlow for GoHighLevel (GHL)", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "FormFlow for GoHighLevel (GHL)", "range": "<= 1.0.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89286", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/e564870a-c124-4c11-90ba-907517155cd0/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T06:17:25.050Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.", "sourceTitle": "CVE-2026-89286", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "FormFlow for GoHighLevel (GHL)", "defaultStatus": "unknown", "versions": [ { "version": "0", "lessThanOrEqual": "1.0.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-106933", "aliases": [], "title": "Blaze Demo Importer：脆弱性情報", "summary": "Blaze Demo Importerに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Blaze Demo Importer", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.8, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "affected": [ { "product": "Blaze Demo Importer", "range": "< 1.0.17" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106933", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/4f85834c-30e4-451f-9616-70dc8eaf9c41/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T06:17:20.817Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.", "sourceTitle": "CVE-2026-106933", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Blaze Demo Importer", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "1.0.17", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ] }, { "id": "CVE-2026-106028", "aliases": [], "title": "ActiveTrail for WooCommerce：脆弱性情報", "summary": "ActiveTrail for WooCommerceに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "ActiveTrail for WooCommerce", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "ActiveTrail for WooCommerce", "range": "<= 1.2.6" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106028", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/0865bdd3-8ce9-4a3b-a174-07076dee8565/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T06:17:20.510Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.", "sourceTitle": "CVE-2026-106028", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "ActiveTrail for WooCommerce", "defaultStatus": "unknown", "versions": [ { "version": "0", "lessThanOrEqual": "1.2.6", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ] }, { "id": "CVE-2026-106014", "aliases": [], "title": "Gateway for Vantiv on WC：脆弱性情報", "summary": "Gateway for Vantiv on WCに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Gateway for Vantiv on WC", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Gateway for Vantiv on WC", "range": "<= 1.0.1" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106014", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/30ccd424-a0a1-40a9-93ab-5def94eb0073/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T06:17:17.607Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying.", "sourceTitle": "CVE-2026-106014", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Gateway for Vantiv on WC", "defaultStatus": "unknown", "versions": [ { "version": "0", "lessThanOrEqual": "1.0.1", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ] }, { "id": "CVE-2026-112111", "aliases": [], "title": "Bootstrap Shortcodes：ブラウザー上での不正な処理", "summary": "Bootstrap Shortcodesにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "product": "Bootstrap Shortcodes", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.1, "cvssVersion": "4.0", "cvssSource": "cve@mitre.org", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "affected": [ { "product": "Bootstrap Shortcodes", "range": "< 3.4.6（機能: bs_tcontent shortcode）" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112111", "label": "NVDの原文" }, { "url": "https://github.com/TheWebShop/bootstrap-shortcodes/commit/c26659ccb6ddb871c7dee1b77cb81cad63e7a75b", "label": "cve@mitre.org" }, { "url": "https://github.com/TheWebShop/bootstrap-shortcodes/releases/tag/3.4.6", "label": "cve@mitre.org" }, { "url": "https://plugins.trac.wordpress.org/browser/bootstrap-shortcodes/tags/3.4.4/inc/bs_tabs.php#L84", "label": "cve@mitre.org" }, { "url": "https://wordpress.org/plugins/bootstrap-shortcodes/", "label": "cve@mitre.org" }, { "url": "https://wordpress.org/plugins/bootstrap-shortcodes/#developers", "label": "cve@mitre.org" } ], "publishedAt": "2026-10-18T23:16:56.583Z", "modifiedAt": "2026-10-19T21:14:14.150Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.", "sourceTitle": "CVE-2026-112111", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Bootstrap Shortcodes project", "product": "Bootstrap Shortcodes", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "packageName": "bootstrap-shortcodes", "modules": [ "bs_tcontent shortcode" ], "programFiles": [ "inc/bs_tabs.php" ], "programRoutines": [ { "name": "bs_tcontent shortcode" } ], "repo": "https://github.com/TheWebShop/bootstrap-shortcodes", "versions": [ { "version": "0", "lessThan": "3.4.6", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:14:14.150Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-96534", "aliases": [], "title": "Modern Events Calendar Lite / Modern Event Calendar Pro：データベースへの不正操作", "summary": "Modern Events Calendar Lite / Modern Event Calendar Proにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "product": "Modern Events Calendar Lite / Modern Event Calendar Pro", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.7, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "affected": [ { "product": "Modern Events Calendar Lite", "range": "< 7.37.0" }, { "product": "Modern Event Calendar Pro", "range": "< 7.37.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96534", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/8c2f8229-1222-49e7-a17f-ef0852f4c805/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-18T07:16:53.680Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.", "sourceTitle": "CVE-2026-96534", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Modern Events Calendar Lite", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "7.37.0", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Unknown", "product": "Modern Event Calendar Pro", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "7.37.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] } ], "total": 328, "limit": 20, "offset": 100, "filters": { "product": "wordpress", "type": "all", "q": "", "page": 6 }, "pagination": { "page": 6, "pageSize": 20, "totalPages": 17 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 1754, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 11, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-22T21:17:13.942Z 〜 2026-10-22T22:18:00.744Z、全製品の変更 373/373件まで確認、対象11件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }