CVE-2024-2876

CVE-2024-2876 - Email Subscribers by Icegram Express 插件中的 SQL 注入漏洞 概述 CVE-2024-2876 是在 WordPress 的 "Email Subscribers by Icegram Express" 插件中发现的一个严重安全漏洞。该漏洞影响 5.7.14 及更早版本，对超过 90,000 个网站构成重大风险。 漏洞详情 CVE 编号 ：CVE-2024-2876 CVSS 评分 ：9.8（严重） 受影响版本 ：5.7.14 及更早版本 已修复版本 ：5.7.15 及以上版本 描述 该漏洞是一个 SQL...

CVE-2026-8347

CVE-2026-8347 – Concrete CMS 中的不安全直接对象引用（IDOR） 概述 CVE-2026-8347 是一个影响 Concrete CMS 9.5.0 及更早版本 的不安全直接对象引用（IDOR）漏洞。该问题存在于 Express 关联重新排序 功能中，原因是授权检查不足。 当用户对关联进行重新排序时，应用程序会验证用户是否具有查看 Express 条目的权限，但未能确认用户是否被授权修改 该条目。因此，权限受限的已认证用户可以操纵另一个 Express 实体的标识符并对其关联进行重新排序，即使没有编辑权限。 与 SQL 注入或远程代码执行漏洞不同，此缺陷不...

CVE-2026-96899

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-96897

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...

CVE-2026-96899 Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

WordPress Optima Express IDX plugin 8.6.0-8.7.5 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Usama Arshad in WordPress Plugin Optima Express + MarketBoost IDX Plugin versions 8.6.0-8.7.5...

EUVD-2026-87900

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...

CVE-2026-96899 Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-96897 Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...

CVE-2026-96897

The Optima Express IDX WordPress plugin (versions 8.5.0 - 8.7.5 ) is vulnerable to an authentication bypass due to a missing authorization check on an AJAX action. This flaw allows unauthenticated attackers to force the creation of a fixed author-role account and repeatedly rotate its application...

EUVD-2026-87901

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-96897 Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...

CVE-2026-96899

The Optima Express IDX WordPress plugin (versions 8.6.0 - 8.7.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw occurs because the plugin fails to properly neutralise a script value submitted via a REST endpoint before storing it and subsequently echoing it into the document head ...

CVE-2026-93901

The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the provisionBlogCredentials function in iHomefinderAdmin.php being reachable via the wpajaxnoprivihfclearcache AJAX action — through the call chain...

EUVD-2026-86601

The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the provisionBlogCredentials function in iHomefinderAdmin.php being reachable via the wpajaxnoprivihfclearcache AJAX action — through the call chain...

CVE-2026-93901 Optima Express IDX <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment

The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the provisionBlogCredentials function in iHomefinderAdmin.php being reachable via the wpajaxnoprivihfclearcache AJAX action — through the call chain...

CVE-2026-93901 Optima Express IDX <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment

The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the provisionBlogCredentials function in iHomefinderAdmin.php being reachable via the wpajaxnoprivihfclearcache AJAX action — through the call chain...

CVE-2026-93901

The Optima Express IDX plugin for WordPress (versions

Mitel MiCollab - Information Disclosure & Denial of Service

Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 contain a vulnerability in the TP-240 component caused by improper handling, letting remote attackers obtain sensitive information and cause denial of service, exploit requires remote access. id: CVE-2022-26143 info: name:...

WordPress Optima Express IDX plugin <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment vulnerability

Unauthenticated Privilege Escalation to 'ihfclearcache' AJAX Action to Author Role Assignment vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Optima Express + MarketBoost IDX Plugin versions = 8.7.5...