6.5Orta

CVE-2026-116395WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

bPlugins LightBox Block Yayım: 2026-10-26 19:46 (17 gün önce)

Açıklama

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0.

Zayıflık türü (CWE): CWE-79

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
bPlugins	LightBox Block	≤ 1.2.0

Kaynaklar ve yamalar

https://patchstack.com/database/wordpress/plugin/lightbox-block/vulnerability/wordpress-lightbox-block-plugin… vdb-entry

CVSS puanı

6.5Orta

Kaynak: Patchstack · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Düşük
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişir
Gizlilik: Düşük
Bütünlük: Düşük
Erişilebilirlik: Düşük

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Tüm puanlar (2)

cna	CVSS 3.1	6.5Orta
audit@patchstack.com	CVSS 3.1	6.5Orta

EPSS (30 günde istismar olasılığı)

0.17%

tüm CVE'lerin %6'inden yüksek

Zaman çizelgesi

Numara ayrıldı2026-10-26
Yayımlandı2026-10-26 19:46
IP-DB'ye ulaştı2026-10-26 20:03
Son güncelleme2026-10-26 21:35

Numarayı veren (CNA): Patchstack
NVD durumu: Deferred

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

Puansız

CVE-2026-124822 2 saat önce

Easy DragDrop File Uploader < 1.1.10 - Unauthenticated Arbitrary File Deletion via Path Traversal

Easy DragDrop File Uploader

The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.

Puansız

CVE-2026-124833 2 saat önce

Ahime Image Printer <= 1.0.0 - Unauthenticated Arbitrary File Upload

Ahime Image Printer

The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server.

Puansız

CVE-2026-125711 2 saat önce

Trustindex Review Widget Plugins < 14.3 - Editor+ Stored XSS via Business Name

Widgets for Google Reviews; WP Tripadvisor Review Widgets; Widgets for Booking.com Reviews; Widgets for Reviews & Recommendations

The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets …

Puansız

CVE-2026-125912 2 saat önce

WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import

WP Ultimate CSV Importer

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbit…

Puansız

CVE-2026-126119 2 saat önce

Streamit Plugin < 1.3.10 - Unauthenticated Remote Code Execution via Arbitrary Function Call

Streamit

The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated …

Puansız

CVE-2026-123097 2 saat önce

WP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync Actions

WP Remote Users Sync

The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any ex…