Skip to content

Commit 865e546

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 3ddc871 commit 865e546

86 files changed

Lines changed: 4364 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/03/GHSA-25rp-rjmq-m7jc/GHSA-25rp-rjmq-m7jc.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-25rp-rjmq-m7jc",
4+
"modified": "2026-03-21T06:30:23Z",
5+
"published": "2026-03-21T06:30:23Z",
6+
"aliases": [
7+
"CVE-2026-1247"
8+
],
9+
"details": "The Survey plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1247"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/survey/tags/1.1/inc/form.php#L73"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/survey/tags/1.1/inc/shortcode.php#L35"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/survey/trunk/inc/form.php#L73"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/survey/trunk/inc/shortcode.php#L35"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d9b6efa-b82e-4fe5-bf56-4ca49e9ebe71?source=cve"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-21T04:16:51Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-27xg-j8cm-6xf2/GHSA-27xg-j8cm-6xf2.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-27xg-j8cm-6xf2",
4+
"modified": "2026-03-21T06:30:24Z",
5+
"published": "2026-03-21T06:30:24Z",
6+
"aliases": [
7+
"CVE-2026-2496"
8+
],
9+
"details": "The Ed's Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `eds_font_awesome` shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2496"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/eds-font-awesome/tags/2.0/eds_font_awesome.php#L103"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/eds-font-awesome/trunk/eds_font_awesome.php#L103"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://wordpress.org/plugins/eds-font-awesome"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/435e8ca8-cf00-4de9-a454-8cb09b7661ef?source=cve"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-79"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-03-21T04:17:05Z"
47+
}
48+
}

‎advisories/unreviewed/2026/03/GHSA-28gh-r3vv-g85j/GHSA-28gh-r3vv-g85j.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-28gh-r3vv-g85j",
4+
"modified": "2026-03-21T06:30:25Z",
5+
"published": "2026-03-21T06:30:25Z",
6+
"aliases": [
7+
"CVE-2026-3506"
8+
],
9+
"details": "The WP-Chatbot for Messenger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the site's MobileMonkey API token and company ID options, which can be used to hijack chatbot configuration and redirect visitor conversations to an attacker-controlled MobileMonkey account.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3506"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/wp-chatbot/tags/4.9/admin/admin.php#L29"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/wp-chatbot/tags/4.9/admin/class-htcc-admin.php#L29"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/wp-chatbot/tags/4.9/inc/MobileMonkeyApi.php#L37"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/wp-chatbot/tags/4.9/inc/MobileMonkeyApi.php#L409"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/browser/wp-chatbot/tags/4.9/inc/MobileMonkeyApi.php#L52"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://plugins.trac.wordpress.org/browser/wp-chatbot/tags/4.9/inc/class-ht-cc.php#L178"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://plugins.trac.wordpress.org/browser/wp-chatbot/trunk/inc/MobileMonkeyApi.php#L37"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/32cce973-bc3b-45f1-ad4d-ff395d3a6c8e?source=cve"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-862"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-03-21T04:17:27Z"
63+
}
64+
}

‎advisories/unreviewed/2026/03/GHSA-294q-4m4m-vwq9/GHSA-294q-4m4m-vwq9.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-294q-4m4m-vwq9",
4+
"modified": "2026-03-21T06:30:25Z",
5+
"published": "2026-03-21T06:30:25Z",
6+
"aliases": [
7+
"CVE-2026-3570"
8+
],
9+
"details": "The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0. This is due to missing authentication and capability checks on the configuration reset functionality in the global scope of smarter-analytics.php. This makes it possible for unauthenticated attackers to reset all plugin configuration and delete all per-page/per-post analytics settings via the 'reset' parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3570"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/smarter-analytics/tags/2.0/smarter-analytics.php#L27"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/smarter-analytics/trunk/smarter-analytics.php#L27"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/06f0d53d-734c-4cc1-902d-bdf4826036bf?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-862"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-21T04:17:30Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-2gqq-gpm5-r66x/GHSA-2gqq-gpm5-r66x.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2gqq-gpm5-r66x",
4+
"modified": "2026-03-21T06:30:25Z",
5+
"published": "2026-03-21T06:30:25Z",
6+
"aliases": [
7+
"CVE-2026-4143"
8+
],
9+
"details": "The Neos Connector for Fakturama plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.0.14. This is due to missing nonce validation in the ncff_add_plugin_page() function which handles settings updates. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4143"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/tags/0.0.14/neosconnectorforfakturama-admin.php#L223"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/tags/0.0.14/neosconnectorforfakturama-admin.php#L231"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/trunk/neosconnectorforfakturama-admin.php#L223"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/trunk/neosconnectorforfakturama-admin.php#L231"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ffc8de-e8e4-41b6-a4b9-79511fb950fc?source=cve"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-352"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-21T04:17:42Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-2rgw-rqcx-h77r/GHSA-2rgw-rqcx-h77r.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2rgw-rqcx-h77r",
4+
"modified": "2026-03-21T06:30:25Z",
5+
"published": "2026-03-21T06:30:25Z",
6+
"aliases": [
7+
"CVE-2026-4022"
8+
],
9+
"details": "The Show Posts list – Easy designs, filters and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_type' shortcode attribute in the 'swiftpost-list' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4022"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/show-posts-shortcodes/tags/1.1.0/post-shortcode.php#L103"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/show-posts-shortcodes/tags/1.1.0/post-shortcode.php#L119"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/show-posts-shortcodes/tags/1.1.0/post-shortcode.php#L21"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/show-posts-shortcodes/tags/1.1.0/post-shortcode.php#L43"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/browser/show-posts-shortcodes/trunk/post-shortcode.php#L103"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://plugins.trac.wordpress.org/browser/show-posts-shortcodes/trunk/post-shortcode.php#L119"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://plugins.trac.wordpress.org/browser/show-posts-shortcodes/trunk/post-shortcode.php#L21"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://plugins.trac.wordpress.org/browser/show-posts-shortcodes/trunk/post-shortcode.php#L43"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc6634bc-4427-44b6-bf77-d97d5b49e82f?source=cve"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-79"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": false,
65+
"github_reviewed_at": null,
66+
"nvd_published_at": "2026-03-21T04:17:39Z"
67+
}
68+
}

0 commit comments

Comments
 (0)