{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-87844", "aliases": [], "title": "PickPlugins Product Designer for WooCommerce：脆弱性情報", "summary": "PickPlugins Product Designer for WooCommerceに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "PickPlugins Product Designer for WooCommerce", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "PickPlugins Product Designer for WooCommerce", "range": "<= 1.0.40" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87844", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/648c7a32-1fc8-44a9-8f52-3aab81a2de55/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-18T07:16:53.560Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.", "sourceTitle": "CVE-2026-87844", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "PickPlugins Product Designer for WooCommerce", "defaultStatus": "unknown", "versions": [ { "version": "0", "lessThanOrEqual": "1.0.40", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-111041", "aliases": [], "title": "AI Engine：脆弱性情報", "summary": "AI Engineに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "AI Engine", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.9, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "affected": [ { "product": "AI Engine", "range": "< 3.7.9" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111041", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/829fef5b-915c-4762-a90d-47a08d78266b/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-18T07:16:52.920Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.", "sourceTitle": "CVE-2026-111041", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "AI Engine", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "3.7.9", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-110981", "aliases": [], "title": "WP Photo Album Plus：脆弱性情報", "summary": "WP Photo Album Plusに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "WP Photo Album Plus", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.1, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "affected": [ { "product": "WP Photo Album Plus", "range": "< 9.2.11.002" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110981", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/8328dd66-924c-4e74-972e-68ce65408159/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-18T07:16:52.817Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.", "sourceTitle": "CVE-2026-110981", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "WP Photo Album Plus", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "9.2.11.002", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-110976", "aliases": [], "title": "AI Engine：脆弱性情報", "summary": "AI Engineに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "AI Engine", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.9, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "affected": [ { "product": "AI Engine", "range": "< 3.7.9" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110976", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/c42eabbf-f357-46cd-b008-1b18eba83bf7/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-18T07:16:52.713Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.", "sourceTitle": "CVE-2026-110976", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "AI Engine", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "3.7.9", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-110070", "aliases": [], "title": "Modern Events Calendar Lite：脆弱性情報", "summary": "Modern Events Calendar Liteに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Modern Events Calendar Lite", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "affected": [ { "product": "Modern Events Calendar Lite", "range": "< 7.36.4" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110070", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/4c7ff021-da5b-44ff-ac99-142b5bdc0790/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-18T07:16:52.610Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.", "sourceTitle": "CVE-2026-110070", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Modern Events Calendar Lite", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "7.36.4", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-110069", "aliases": [], "title": "Modern Events Calendar Lite：脆弱性情報", "summary": "Modern Events Calendar Liteに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Modern Events Calendar Lite", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "Modern Events Calendar Lite", "range": "< 7.37.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110069", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/5d5a24fe-1fb9-48ae-bd5c-de95b04c5f21/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-18T07:16:52.500Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.", "sourceTitle": "CVE-2026-110069", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Modern Events Calendar Lite", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "7.37.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-110035", "aliases": [], "title": "Salon Booking System：脆弱性情報", "summary": "Salon Booking Systemに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Salon Booking System", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "Salon Booking System", "range": "< 10.31.11" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110035", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/146eaa60-08e8-43b2-8d87-74e79261d422/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-18T07:16:52.397Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.", "sourceTitle": "CVE-2026-110035", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Salon Booking System", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "10.31.11", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-110033", "aliases": [], "title": "Salon Booking System：脆弱性情報", "summary": "Salon Booking Systemに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Salon Booking System", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.8, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "affected": [ { "product": "Salon Booking System", "range": "< 10.31.11" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110033", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/6c8f3d74-7aa6-4b4e-96d0-ee89fc47a255/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-18T07:16:52.287Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.", "sourceTitle": "CVE-2026-110033", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Salon Booking System", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "10.31.11", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-110032", "aliases": [], "title": "Salon Booking System：脆弱性情報", "summary": "Salon Booking Systemに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Salon Booking System", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.5, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L", "affected": [ { "product": "Salon Booking System", "range": "< 10.31.11" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110032", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/07310082-5ccc-4703-9344-2bd6e823b245/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-18T07:16:52.183Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.", "sourceTitle": "CVE-2026-110032", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Salon Booking System", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "10.31.11", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-110031", "aliases": [], "title": "Salon Booking System：脆弱性情報", "summary": "Salon Booking Systemに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Salon Booking System", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Salon Booking System", "range": ">= 10.17 / < 10.31.11" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110031", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/8d24ad5b-2d50-467b-9c40-45e86e53dafb/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-18T07:16:52.077Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.", "sourceTitle": "CVE-2026-110031", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Salon Booking System", "defaultStatus": "unaffected", "versions": [ { "version": "10.17", "lessThan": "10.31.11", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-110026", "aliases": [], "title": "Tasty Recipes Lite：脆弱性情報", "summary": "Tasty Recipes Liteに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Tasty Recipes Lite", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.9, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "affected": [ { "product": "Tasty Recipes Lite", "range": ">= 1.2 / < 1.2.11" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110026", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/fc8fc746-9ee1-4364-881f-28ff598f007c/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-18T07:16:51.967Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus.", "sourceTitle": "CVE-2026-110026", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Tasty Recipes Lite", "defaultStatus": "unaffected", "versions": [ { "version": "1.2", "lessThan": "1.2.11", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-109937", "aliases": [], "title": "Otter Blocks：脆弱性情報", "summary": "Otter Blocksに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Otter Blocks", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.4, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "affected": [ { "product": "Otter Blocks", "range": "< 3.2.3" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109937", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/9765313d-c879-457f-851f-dab74b8d90a0/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-18T07:16:50.927Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.", "sourceTitle": "CVE-2026-109937", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Otter Blocks", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "3.2.3", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-111110", "aliases": [], "title": "Payment forms, Buy now buttons, and Invoicing System | GetPaid：ブラウザー上での不正な処理", "summary": "Payment forms, Buy now buttons, and Invoicing System | GetPaidにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "product": "Payment forms, Buy now buttons, and Invoicing System | GetPaid", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Payment forms, Buy now buttons, and Invoicing System | GetPaid", "range": "<= 2.8.61" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111110", "label": "NVDの原文" }, { "url": "https://github.com/AyeCode/invoicing/archive/refs/heads/master.zip", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/admin/meta-boxes/class-mb-payment-form.php#L30", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/class-wpinv-ajax.php#L359", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/payments/class-getpaid-checkout.php#L293", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/payments/class-getpaid-checkout.php#L402", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/payments/class-getpaid-payment-form-submission.php#L150", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3750463/invoicing/trunk/includes/admin/meta-boxes/class-mb-payment-form.php", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2161ecdc-d3c2-4ede-9c42-28f30fa0f91e?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-17T08:16:28.310Z", "modifiedAt": "2026-10-19T15:16:45.150Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce (getpaid_form_nonce) is publicly emitted to all visitors via wp_localize_script as WPInv.formNonce, meaning no authentication or prior nonce leak is needed; the stored payload fires when an administrator views the affected invoice's Payment Form Details metabox.", "sourceTitle": "CVE-2026-111110", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "stiofansisland", "product": "Payment forms, Buy now buttons, and Invoicing System | GetPaid", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "2.8.61", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T15:16:45.150Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-110253", "aliases": [], "title": "weForms – Easy Drag & Drop Contact Form Builder For WordPress：脆弱性情報", "summary": "weForms – Easy Drag & Drop Contact Form Builder For WordPressに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "weForms – Easy Drag & Drop Contact Form Builder For WordPress", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.4, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "affected": [ { "product": "weForms – Easy Drag & Drop Contact Form Builder For WordPress", "range": "<= 1.6.28" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110253", "label": "NVDの原文" }, { "url": "https://github.com/BoldGrid/weforms/tree/1.6.29", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.28/includes/class-ajax.php#L1056", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.28/includes/class-ajax.php#L627", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.28/includes/class-ajax.php#L711", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.28/includes/fields/class-field-image.php#L138", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.28/includes/functions.php#L362", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cb7478fa-418d-43ce-8db7-b7ede06574df?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-17T08:16:28.167Z", "modifiedAt": "2026-10-19T15:16:45.150Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and including, 1.6.28 This makes it possible for unauthenticated attackers to delete arbitrary media files on the server. This requires an administrator to permanently delete the poisoned form entry, a routine moderation action for spam-looking submissions that an attacker can prompt through social engineering.", "sourceTitle": "CVE-2026-110253", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "boldgrid", "product": "weForms – Easy Drag & Drop Contact Form Builder For WordPress", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "1.6.28", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T15:16:45.150Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-109983", "aliases": [], "title": "YMC Filter：ブラウザー上での不正な処理", "summary": "YMC Filterにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "product": "YMC Filter", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.4, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "YMC Filter", "range": "<= 3.12.19" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109983", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.19/ymc2/assets/js/frontend/ymc-public.min.js#L10", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.19/ymc2/src/api/abstracts/FG_REST_Abstract_Controller.php#L66", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.19/ymc2/src/api/controllers/frontend/FG_REST_Frontend_Search_Controller.php#L135", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.19/ymc2/src/api/controllers/frontend/FG_REST_Frontend_Search_Controller.php#L148", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.20/ymc2/src/api/controllers/frontend/FG_REST_Frontend_Search_Controller.php", "label": "security@wordfence.com" }, { "url": "https://wordpress.org/plugins/ymc-smart-filter", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27cfa62d-ba16-4344-be0c-82cac4d21d1c?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-17T08:16:28.020Z", "modifiedAt": "2026-10-19T15:16:45.150Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The autocomplete REST endpoint is registered with a permission callback that unconditionally returns true, meaning any site visitor — including unauthenticated users — can trigger the payload simply by typing in the YMC filter search box, while only Author-level access is required to store it.", "sourceTitle": "CVE-2026-109983", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "wssoffice21", "product": "YMC Filter", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "3.12.19", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T15:16:45.150Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-100316", "aliases": [], "title": "European VAT Compliance Assistant for WooCommerce：ブラウザー上での不正な処理", "summary": "European VAT Compliance Assistant for WooCommerceにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "product": "European VAT Compliance Assistant for WooCommerce", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "European VAT Compliance Assistant for WooCommerce", "range": "<= 1.36.10" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100316", "label": "NVDの原文" }, { "url": "https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-compliance/tags/1.36.10/bootstrap.php#L1779", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-compliance/tags/1.36.10/record-order-details.php#L222", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-compliance/tags/1.36.10/record-order-details.php#L740", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3713548/woocommerce-eu-vat-compliance/trunk/record-order-details.php", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame&new=3713548%40woocommerce-eu-vat-compliance&old=3676299%40woocommerce-eu-vat-compliance", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9f17d266-e64f-4721-9c8d-5bc72791ef01?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-17T08:16:26.950Z", "modifiedAt": "2026-10-19T15:16:45.150Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious header value is persisted verbatim into order post-meta during a guest checkout, meaning no account or authentication is required to plant the payload.", "sourceTitle": "CVE-2026-100316", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "davidanderson", "product": "European VAT Compliance Assistant for WooCommerce", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "1.36.10", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T15:16:45.150Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ] }, { "id": "CVE-2026-110384", "aliases": [], "title": "Fancy Comments WordPress：ブラウザー上での不正な処理", "summary": "Fancy Comments WordPressにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "product": "Fancy Comments WordPress", "category": "wordpress", "component": "unknown", "severity": "high", "cvss": 7.1, "cvssVersion": "3.1", "cvssSource": "audit@patchstack.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "affected": [ { "product": "Fancy Comments WordPress", "range": "<= 1.2.21" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110384", "label": "NVDの原文" }, { "url": "https://patchstack.com/database/wordpress/plugin/fancy-facebook-comments/vulnerability/wordpress-fancy-comments-wordpress-plugin-1-2-21-cross-site-scripting-xss-vulnerability?_s_id=cve", "label": "audit@patchstack.com" } ], "publishedAt": "2026-10-17T07:16:50.350Z", "modifiedAt": "2026-10-19T15:16:45.150Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21.", "sourceTitle": "CVE-2026-110384", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Heateor Support", "product": "Fancy Comments WordPress", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "packageName": "fancy-facebook-comments", "versions": [ { "version": "0", "lessThanOrEqual": "1.2.21", "versionType": "custom", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T15:16:45.150Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-97314", "aliases": [], "title": "ThirstyAffiliates：脆弱性情報", "summary": "ThirstyAffiliatesに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "ThirstyAffiliates", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "affected": [ { "product": "ThirstyAffiliates", "range": "< 3.12.1" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97314", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/37e0a31e-39cc-4035-ae27-b34e7ec8f0d0/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-17T06:16:34.553Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:50.314Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.", "sourceTitle": "CVE-2026-97314", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "ThirstyAffiliates", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "3.12.1", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:50.314Z", "state": "published" } ] }, { "id": "CVE-2026-92433", "aliases": [], "title": "Patreon WordPress：意図しない操作", "summary": "Patreon WordPressに意図しない操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "ログイン中の利用者に、意図しない操作を実行させる可能性があります。", "product": "Patreon WordPress", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "affected": [ { "product": "Patreon WordPress", "range": "< 1.10.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92433", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/ea970f2e-0fe8-4fef-99ff-a74255fa5a04/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-17T06:16:34.457Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.", "sourceTitle": "CVE-2026-92433", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Patreon WordPress", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "1.10.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-92432", "aliases": [], "title": "Patreon WordPress：脆弱性情報", "summary": "Patreon WordPressに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Patreon WordPress", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "affected": [ { "product": "Patreon WordPress", "range": "< 1.10.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92432", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/8f9a085f-dc4d-46c2-a738-3c2ab562b90c/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-17T06:16:34.357Z", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.", "sourceTitle": "CVE-2026-92432", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Patreon WordPress", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "1.10.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:04:50.950Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] } ], "total": 328, "limit": 20, "offset": 120, "filters": { "product": "wordpress", "type": "all", "q": "", "page": 7 }, "pagination": { "page": 7, "pageSize": 20, "totalPages": 17 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 1754, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 11, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-22T21:17:13.942Z 〜 2026-10-22T22:18:00.744Z、全製品の変更 373/373件まで確認、対象11件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }