7.1Yüksek

CVE-2026-48865WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability

ThimPress LearnPress Yayım: 2026-06-01 17:41 (5 ay önce)

Açıklama

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress allows Reflected XSS. This issue affects LearnPress: from n/a through 4.3.6.

Zayıflık türü (CWE): CWE-79

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
ThimPress	LearnPress	≤ 4.3.6

Kaynaklar ve yamalar

https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-3-6-r… vdb-entry

CVSS puanı

7.1Yüksek

Kaynak: Patchstack · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişir
Gizlilik: Düşük
Bütünlük: Düşük
Erişilebilirlik: Düşük

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Tüm puanlar (2)

cna	CVSS 3.1	7.1Yüksek
audit@patchstack.com	CVSS 3.1	7.1Yüksek

EPSS (30 günde istismar olasılığı)

0.20%

tüm CVE'lerin %10'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2026-05-25
Yayımlandı2026-06-01 17:41
IP-DB'ye ulaştı2026-10-24 23:44
Son güncelleme2026-07-22 10:10

Numarayı veren (CNA): Patchstack
NVD durumu: Deferred

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

6.5Orta

CVE-2026-121794 1 saat önce

Travelly <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit Screen

magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.11 This is due to the plugin not properly verifying that a user is authorized to perform an actio…

6.4Orta

CVE-2026-122222 1 saat önce

Permalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug

mbis Permalink Manager Lite

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authentica…

7.2Yüksek

CVE-2026-110291 1 saat önce

Graphina <= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings

iqonicdesign Graphina – Charts and Graphs For Elementor

The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iq_tree_chart_node_font_family (and any text control serialized into chart_data['settings'])' parameter in all versions up to, and includ…

6.4Orta

CVE-2026-118189 1 saat önce

Posts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute

barn2media Posts Table with Search & Sort

The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possibl…

6.4Orta

CVE-2026-120671 1 saat önce

UsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute

stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'badge' parameter in all versions up to, and including, 1.2.80 due to insufficient …

6.5Orta

CVE-2026-119472 2 saat önce

WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability

David Anderson Redux Framework

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16.