9.8Kritik

CVE-2026-54859WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

ThemeREX Preservation Yayım: 2026-10-29 18:24 (7 gün önce)

Açıklama

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

Zayıflık türü (CWE): CWE-502

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
ThemeREX	Preservation	≤ 1.15

Kaynaklar ve yamalar

https://patchstack.com/database/wordpress/theme/preservation/vulnerability/wordpress-preservation-theme-1-15-… vdb-entry

CVSS puanı

9.8Kritik

Kaynak: Patchstack · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tüm puanlar (2)

cna	CVSS 3.1	9.8Kritik
audit@patchstack.com	CVSS 3.1	9.8Kritik

EPSS (30 günde istismar olasılığı)

0.53%

tüm CVE'lerin %45'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: yes
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2026-06-16
Yayımlandı2026-10-29 18:24
IP-DB'ye ulaştı2026-10-29 19:03
Son güncelleme2026-10-29 23:17

Numarayı veren (CNA): Patchstack
NVD durumu: Deferred

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

7.1Yüksek

CVE-2026-115431 2 saat önce

WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability

WP Swings Upsell Order Bump Offer for WooCommerce

Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce…

6.5Orta

CVE-2026-115952 2 saat önce

WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability

WPMU DEV Forminator

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3.

7.1Yüksek

CVE-2026-109883 2 saat önce

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Elementor Elementor Website Builder

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.

7.1Yüksek

CVE-2026-109884 2 saat önce

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Elementor Elementor Website Builder

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.

5.4Orta

CVE-2026-103908 3 saat önce

AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info

mohammed_kaludi AMP for WP – Accelerated Mobile Pages

The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a v…

5.4Orta

CVE-2026-107658 3 saat önce

BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion

themekraft BuddyForms

The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes…