CVE-2026-2413

CVE-2026-2413 Ally – Web Accessibility & Usability = 4.0.3 - 通过 URL 路径的未认证 SQL 注入 描述 Ally – Web Accessibility & Usability WordPress 插件在 4.0.3 及之前的所有版本中，存在通过 URL 路径触发的 SQL 注入漏洞。原因是 getglobalremediations 方法对用户提供的 URL 参数转义不足，该参数未经正确的 SQL 上下文净化，直接拼接进 SQL JOIN 子句。虽然使用了 escurlraw 来保证 URL 安全，但它无法阻止 SQL...

CVE-2026-2413-POC

CVE-2026-2413-POC Ally – WordPress 的无障碍与可用性插件（Web Accessibility & Usability plugin）在所有版本（包括 4.0.3 及更早版本）中，存在通过 URL 路径触发的 SQL 注入漏洞。该漏洞源于 getglobalremediations 方法对用户提供的 URL 参数转义不足，该参数被直接拼接进 SQL JOIN 子句中，且未针对 SQL 上下文进行适当的净化处理。虽然使用了 escurlraw 来确保 URL 安全，但它无法阻止 SQL 元字符（单引号、括号）被注入。这使得未认证的攻击者能够将额外的 SQL...

CVE-2026-2413: Improper Neutralization of Special Elements used in an SQL Command

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the getglobalremediations method, where it is directly concatenated...

WordPress plugin Ally – Web Accessibility & Usability SQL注入漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

SmarterMail 100.0.9413 Vulnerability Scanner

This PHP class implements a non-intrusive vulnerability scanner designed to assess the exposure of a SmarterMail instance to a file upload–related security flaw without executing any commands or payloads. The scanner follows a safe, read-only validation approach that focuses on detecting improper...

CVE-2025-13113: Exposure of Sensitive Information to an Unauthorized Actor

The Web Accessibility by accessiBe plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11. This is due to the accessiberenderjsinfooter function logging the complete plugin options array to the browser console on public pages, without...

WordPress Web Accessibility by accessiBe plugin <= 2.11 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Web Accessibility By accessiBe versions = 2.11...

CVE-2026-24629

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ability, Inc Web Accessibility with Max Access accessibility-toolbar allows Stored XSS.This issue affects Web Accessibility with Max Access: from n/a through = 2.1.0...

CVE-2026-24629

CVE-2026-24629 concerns a stored cross-site scripting (XSS) vulnerability in the WordPress plugin Web Accessibility with Max Access (accessibility-toolbar) by Ability, Inc. The issue arises from improper input neutralization during web page generation and affects the product family as deployed in...

CVE-2026-24629 WordPress Web Accessibility with Max Access plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ability, Inc Web Accessibility with Max Access accessibility-toolbar allows Stored XSS.This issue affects Web Accessibility with Max Access: from n/a through = 2.1.0...

CVE-2026-24629

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ability, Inc Web Accessibility with Max Access accessibility-toolbar allows Stored XSS.This issue affects Web Accessibility with Max Access: from n/a through = 2.1.0...

CVE-2026-24629 WordPress Web Accessibility with Max Access plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ability, Inc Web Accessibility with Max Access accessibility-toolbar allows Stored XSS.This issue affects Web Accessibility with Max Access: from n/a through = 2.1.0...

WordPress plugin Web Accessibility with Max Access has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

CVE-2026-24629: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ability, Inc Web Accessibility with Max Access accessibility-toolbar allows Stored XSS.This issue affects Web Accessibility with Max Access: from n/a through = 2.1.0...

PT-2026-4459

Name of the Vulnerable Software and Affected Versions Ability, Inc Web Accessibility with Max Access versions through 2.1.0 Description The software contains a flaw due to improper neutralization of input during web page generation, specifically a Stored Cross-site Scripting issue. This allows fo...

WordPress Web Accessibility with Max Access plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Akshat Parikh in WordPress Plugin Web Accessibility with Max Access versions = 2.1.0...

CVE-2025-49920

Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through = 2.10...

EUVD-2025-35538

Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through = 2.10...

CVE-2025-49920 WordPress Web Accessibility By accessiBe plugin <= 2.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through = 2.10...

CVE-2025-49920: Missing Authorization

Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through = 2.10...