9.8Kritik

CVE-2026-95606WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability

Liquid Web / StellarWP The Events Calendar Yayım: 2026-10-07 20:07 (26 gün önce)

Açıklama

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.

Zayıflık türü (CWE): CWE-502

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
Liquid Web / StellarWP	The Events Calendar	≤ 6.17.4

Kaynaklar ve yamalar

https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calen… vdb-entry

CVSS puanı

9.8Kritik

Kaynak: Patchstack · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tüm puanlar (2)

cna	CVSS 3.1	9.8Kritik
audit@patchstack.com	CVSS 3.1	9.8Kritik

EPSS (30 günde istismar olasılığı)

0.32%

tüm CVE'lerin %25'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: yes
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2026-09-22
Yayımlandı2026-10-07 20:07
IP-DB'ye ulaştı2026-10-24 23:48
Son güncelleme2026-10-08 20:24

Numarayı veren (CNA): Patchstack
NVD durumu: Deferred

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

8.8Yüksek

CVE-2026-76124 2 saat önce

BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint

BuddyBoss BuddyBoss App

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type h…

5.3Orta

CVE-2026-91075 6 saat önce

Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypass

Eupago Gateway For Woocommerce

The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark…

5.3Orta

CVE-2026-103327 6 saat önce

CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook Secret

CryptoCloud

The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthe…

Puansız

CVE-2026-103379 8 saat önce

WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token

WATI Chat and Notification

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order…

Puansız

CVE-2026-104647 8 saat önce

weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()

weMail

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as autho…

Puansız

CVE-2026-104648 8 saat önce

weMail <= 2.1.6 - Editor+ API Key Disclosure

weMail

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credentia…