IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.8Yüksek

CVE-2026-118073WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability

blazethemes News Kit Elementor Addons Yayım: (4 gün önce)

Açıklama

Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.

Zayıflık türü (CWE): CWE-502

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
blazethemes News Kit Elementor Addons ≤ 1.5.0

Kaynaklar ve yamalar

Aynı üründe son açıklar — WordPress plugins & themes

8.1Yüksek
CVE-2026-120577

FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter

wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it p…

8.1Yüksek
CVE-2026-120538

Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture

smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field…