IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.8Yüksek

CVE-2025-3418WPC Admin Columns 2.0.6 - 2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update

wpclever WPC Admin Columns Yayım: (1 yıl önce)

Açıklama

The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting user meta values that can be updated through the ajax_edit_save() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to that of an administrator.

Zayıflık türü (CWE): CWE-269

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
wpclever WPC Admin Columns 2.0.6 – ≤ 2.1.0

Kaynaklar ve yamalar

Aynı üründe son açıklar — WordPress plugins & themes

7.2Yüksek
CVE-2026-120687

Lightbox & Modal Popup WordPress Plugin <= 2.8.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Image Alt Attribute in .wp-caption Containers

fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient…

9.8Kritik
CVE-2026-19907

Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator

shipo Shipo

The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's c…