7.1Yüksek

CVE-2026-57397WordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability

ThimPress. Coaching Yayım: 2026-07-23 14:18 (3 ay önce)

Açıklama

Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.

Zayıflık türü (CWE): CWE-79

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
ThimPress.	Coaching	≤ 3.9.2

Kaynaklar ve yamalar

https://patchstack.com/database/wordpress/theme/coaching/vulnerability/wordpress-coaching-theme-3-9-2-cross-s… vdb-entry

CVSS puanı

7.1Yüksek

Kaynak: Patchstack · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişir
Gizlilik: Düşük
Bütünlük: Düşük
Erişilebilirlik: Düşük

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Tüm puanlar (2)

cna	CVSS 3.1	7.1Yüksek
audit@patchstack.com	CVSS 3.1	7.1Yüksek

EPSS (30 günde istismar olasılığı)

0.25%

tüm CVE'lerin %17'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2026-06-24
Yayımlandı2026-07-23 14:18
IP-DB'ye ulaştı2026-10-24 23:42
Son güncelleme2026-10-24 16:10

Numarayı veren (CNA): Patchstack
NVD durumu: Deferred

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

7.1Yüksek

CVE-2026-115431 3 saat önce

WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability

WP Swings Upsell Order Bump Offer for WooCommerce

Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce…

6.5Orta

CVE-2026-115952 3 saat önce

WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability

WPMU DEV Forminator

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3.

7.1Yüksek

CVE-2026-109883 4 saat önce

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Elementor Elementor Website Builder

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.

7.1Yüksek

CVE-2026-109884 4 saat önce

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Elementor Elementor Website Builder

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.

5.4Orta

CVE-2026-103908 4 saat önce

AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info

mohammed_kaludi AMP for WP – Accelerated Mobile Pages

The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a v…

5.4Orta

CVE-2026-107658 4 saat önce

BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion

themekraft BuddyForms

The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes…