4.3Orta

CVE-2026-97072WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

myCred myCred Yayım: 2026-11-03 20:02 (2 gün önce)

Açıklama

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

Zayıflık türü (CWE): CWE-862

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
myCred	myCred	≤ 4.0.2

Kaynaklar ve yamalar

https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-broken-ac… vdb-entry

CVSS puanı

4.3Orta

Kaynak: Patchstack · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Düşük
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yok
Bütünlük: Düşük
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Tüm puanlar (2)

cna	CVSS 3.1	4.3Orta
audit@patchstack.com	CVSS 3.1	4.3Orta

EPSS (30 günde istismar olasılığı)

0.20%

tüm CVE'lerin %10'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2026-09-24
Yayımlandı2026-11-03 20:02
IP-DB'ye ulaştı2026-11-03 21:03
Son güncelleme2026-11-03 21:18

Numarayı veren (CNA): Patchstack
NVD durumu: Deferred

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

7.1Yüksek

CVE-2026-109883 1 saat önce

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Elementor Elementor Website Builder

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.

7.1Yüksek

CVE-2026-109884 1 saat önce

WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Elementor Elementor Website Builder

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.

5.4Orta

CVE-2026-103908 2 saat önce

AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info

mohammed_kaludi AMP for WP – Accelerated Mobile Pages

The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a v…

5.4Orta

CVE-2026-107658 2 saat önce

BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion

themekraft BuddyForms

The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes…

5.4Orta

CVE-2026-120035 2 saat önce

RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title

themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed <item><title>)' parameter in all versions up to, and inclu…

8.8Yüksek

CVE-2026-116624 2 saat önce

Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form

danbilabs Advanced Members for ACF

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This…