WordPress plugin Royal Elementor Addons 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-4117

creationtimestamp| type| source ---|---|--- 2026-04-23 23:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mk76czqxax2s...

CVE-2026-26150

creationtimestamp| type| source ---|---|--- 2026-04-23 23:27:09+00:00| published-proof-of-concept| Telegram/kiTcjsXT1hi2Y3u94e7GhzIuEtNJE-kdjO7sui75MorBPg 2026-04-24 02:02:30+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mk7go5ymgr2v 2026-04-25 01:11:03+00:00| seen|...

CVE-2026-24303

creationtimestamp| type| source ---|---|--- 2026-04-23 23:27:09+00:00| published-proof-of-concept| Telegram/kiTcjsXT1hi2Y3u94e7GhzIuEtNJE-kdjO7sui75MorBPg 2026-04-24 02:01:21+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mk7gm4it4l23 2026-04-25 01:11:11+00:00| seen|...

CVE-2026-41349

creationtimestamp| type| source ---|---|--- 2026-04-23 22:25:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk72kw6rkh2r 2026-04-23 22:27:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk72mstot72n 2026-04-23 23:27:23+00:00| seen|...

CVE-2026-41352

creationtimestamp| type| source ---|---|--- 2026-04-23 22:25:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk72khezae2n 2026-04-23 23:27:23+00:00| seen| Telegram/OgOvWOsYKDsUPw2Tk2S9qGbonIgzDZlRsoTRSBtlTZ01pNI 2026-04-24 09:18:39+00:00| seen|...

DEBIAN-CVE-2026-28525

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoosemultipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing...

CVE-2026-28525 SWUpdate Integer Underflow in Multipart Upload Parser

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoosemultipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing...

CVE-2026-28525 SWUpdate Integer Underflow in Multipart Upload Parser

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoosemultipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing...

CVE-2026-28525

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoosemultipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing...

CVE-2026-28525

SWUpdate contains an integer underflow in the multipart upload parser (mongoose_multipart.c) that enables unauthenticated remote denial of service. An attacker can trigger an underflow in mg_http_multipart_continue_wait_for_chunk() by sending a crafted HTTP POST to /upload with a malformed multip...

CVE-2026-28525

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoosemultipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing...

CVE-2026-28525 SWUpdate Integer Underflow in Multipart Upload Parser

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoosemultipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing...

CVE-2026-4088

The Switch CTA Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wppwctabox' shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping on user-supplied post meta values including 'ctaboxbuttonlink',...

CVE-2026-6947

creationtimestamp| type| source ---|---|--- 2026-04-23 20:38:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10865-de323-2.html 2026-04-24 04:50:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk7q3227u32z 2026-04-24 05:19:04+00:00| seen|...

CVE-2026-41460

creationtimestamp| type| source ---|---|--- 2026-04-23 19:43:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6rhqgrmc2q 2026-04-24 15:21:36+00:00| published-proof-of-concept| Telegram/l8-tUjdZo5KblLOe421TQB8MZuX2H9CaOdWKzaRMJrauLgw 2026-05-31 22:07:08+00:00| seen|...

CVE-2026-40471

creationtimestamp| type| source ---|---|--- 2026-04-23 19:39:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6rapfj252t 2026-04-24 15:22:14+00:00| seen| Telegram/9MQPqn6NQB4yNQwBhEjQmfZAQamilmjjvNDDQhjtzrN-0VE...

CVE-2026-31177

creationtimestamp| type| source ---|---|--- 2026-04-23 19:36:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6r4jdrn42l...

CVE-2026-31181

creationtimestamp| type| source ---|---|--- 2026-04-23 19:34:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6qyq43am2l...

CVE-2026-40886

creationtimestamp| type| source ---|---|--- 2026-04-23 19:33:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6qw2mi3g2c 2026-04-23 21:25:56+00:00| seen| Telegram/vObnyALXsyXLFJkccB0eoKwgfsCPRSJaAgpRRcRjZAUW0s...