5.9Orta

CVE-2025-60183WordPress Silencesoft RSS Reader Plugin <= 0.6 - Cross Site Scripting (XSS) Vulnerability

silence Silencesoft RSS Reader Yayım: 2026-02-20 18:46 (8 ay önce)

Açıklama

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Stored XSS.This issue affects Silencesoft RSS Reader: from n/a through <= 0.6.

Zayıflık türü (CWE): CWE-79

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
silence	Silencesoft RSS Reader	≤ 0.6

Kaynaklar ve yamalar

https://patchstack.com/database/Wordpress/Plugin/external-rss-reader/vulnerability/wordpress-silencesoft-rss-… vdb-entry

CVSS puanı

5.9Orta

Kaynak: Patchstack · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yüksek
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişir
Gizlilik: Düşük
Bütünlük: Düşük
Erişilebilirlik: Düşük

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Tüm puanlar (2)

cna	CVSS 3.1	5.9Orta
audit@patchstack.com	CVSS 3.1	5.9Orta

EPSS (30 günde istismar olasılığı)

0.27%

tüm CVE'lerin %19'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2025-09-25
Yayımlandı2026-02-20 18:46
IP-DB'ye ulaştı2026-10-24 23:59
Son güncelleme2026-06-17 12:49

Numarayı veren (CNA): Patchstack
NVD durumu: Deferred

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

5.3Orta

CVE-2026-92408 1 saat önce

WPS Bookings for WooCommerce < 3.13.1 - Unauthenticated Price Manipulation via booking_price

WPS Bookings for WooCommerce

The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, includin…

5.3Orta

CVE-2026-123668 1 saat önce

GetPaid 2.8.63 - 2.8.64 - Unauthenticated Payment Bypass via Fractional Item Quantity

GetPaid

The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.

5.3Orta

CVE-2026-123659 1 saat önce

ProfilePress < 4.17.6 - Unauthenticated Member Directory Role Restriction Bypass and User Meta Disclosure

ProfilePress

The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover…

6.5Orta

CVE-2026-119302 1 saat önce

NotificationX < 3.3.7 - Unauthenticated Non-Public Content Disclosure and Arbitrary Shortcode Execution via Notification Preview

NotificationX

The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and…

5.3Orta

CVE-2026-119171 1 saat önce

Advanced Product Fields (Product Addons) for WooCommerce 1.6.22 - 1.7.3 - Unauthenticated Paid Option Surcharge Bypass via Add-to-Cart Choice Field

Advanced Product Fields (Product Addons) for WooCommerce

The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthent…

8.1Yüksek

CVE-2026-111190 1 saat önce

ARForms <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header

ARforms

The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restric…